Hardware wallet maker Trezor said in a blog post on 30 October 2026 that its security team received a responsible-disclosure report on 28 October of a hardware implant in a Trezor Safe 5 bought in August 2026 from CryptoBilis, until October an official Trezor reseller in Southeast Asia, through the marketplace Tokopedia.

Trezor says it has not yet received the device to confirm the report, but based on the customer's description, photos and a video interview it is treating the report as credible and warning customers now as a precaution; its lab will examine the device when it arrives.

According to the report, which Trezor says it has not verified itself, an extra circuit board with a cellular module and antenna sits between the main board and the screen, reads what the screen shows, including the wallet backup (recovery phrase), and sends it out over a mobile network whenever the device is plugged in.

Trezor says the implant appears to operate similarly to those seen in Ledger devices but will not draw comparisons while investigations continue, and does not know who is behind it.

Trezor says no CryptoBilis buyer has reported a loss of funds, that the reporting customer had moved his funds before finding the board, and that it has no reports involving any other reseller. Trezor removed CryptoBilis as a reseller on 9 October 2026, after Ledger began investigating fund losses among its own CryptoBilis buyers. Trezor's advice covers every Trezor model bought from CryptoBilis since March 2026, including through any store selling CryptoBilis-supplied devices; it will ship a new device or give a voucher to those buyers, and warns that scammers are likely to use the incident for phishing by email, letter and phone. (source: Trezor)

The Hacker News covered the warning on 30 October. (source: The Hacker News)