Trezor Receives Report on Suspected Implant

Trezor confirmed receipt of a security disclosure on October 28 concerning a Trezor Safe 5 unit purchased by a customer in Indonesia via Tokopedia in August 2026. The buyer reported discovering an additional circuit board positioned between the main board and the screen. This component includes a cellular module and antenna, according to the customer's account.

The device, bought through the reseller, could capture information displayed on the wallet screen, including recovery phrases generated during initial setup, and transmit them over a mobile network whenever powered. Such an implant would allow an attacker to restore the wallet on another device and access funds without the original hardware. The customer had already moved cryptocurrencies out of the wallet prior to identifying the additional board.

Trezor has not physically examined the reported device but reviewed photographs and conducted a video interview with the buyer. The company considers the information credible and has treated the report as sufficient to act. No customer losses have been reported in connection with this incident.

Historical Context with CryptoBilis and Ledger Devices

CryptoBilis operated as an authorized reseller for Trezor and Ledger in Southeast Asia until its removal from Trezor’s list on October 9. Ledger began investigating cryptocurrency losses after reports surfaced on October 9 involving tampered devices sold through the same reseller. The tampering involved an unauthorized component that captured recovery phrases displayed during setup and transmitted them via an LTE cellular connection, separate from the device’s security chip and normal operating functions.

Blockchain analytics firm Arkham Intelligence traced approximately $95.35 million in suspected stolen funds across 1,486 addresses between October 7 and 9, with around $10 million in USDT frozen at the time. Singapore police separately reported S$3.5 million in losses from two cases tied to tampered Ledger wallets purchased through local retailers.

Trezor had earlier received alerts in August from security researcher Joe Grand about tampered Trezor One and Model T wallets obtained from unauthorized sellers on platforms such as TikTok and Facebook. The company maintained that its safeguards addressed counterfeit devices and modified firmware in authorized channels but acknowledged the implants operated undetected in some instances.

Trezor Removes CryptoBilis and Expands Scrutiny

Following the initial reports, Trezor restricted its authorized reseller network and began collecting devices for inspection. By October 19, it had received four wallets from CryptoBilis, including two Safe 5 units, a Safe 7 and a Safe 3, with none showing signs of physical tampering.

The suspected implant in the October 28-reported Safe 5 was not among those examined. Trezor has now expanded its advisory to all Trezor models supplied by CryptoBilis since March 2026, including those sold via Tokopedia and other retailers that sourced inventory from the reseller. The company states that sales through CryptoBilis were very small in volume.

Recommended Actions for Affected Customers

Customers who purchased Trezor devices from CryptoBilis during the specified period are advised to transfer their cryptocurrency holdings to a newly created wallet with a completely new recovery phrase. Importing an existing recovery phrase into another hardware or software wallet does not eliminate the risk if it has already been exposed.

Those without a secure hardware wallet may temporarily use a familiar software wallet or exchange while verifying receiving addresses. Anyone who has not yet configured a device should avoid setting it up or entering an existing recovery phrase. Trezor has warned that opening or weighing wallets cannot reliably detect tampering and that customers should not attempt to identify modifications themselves.

Eligible buyers may receive a replacement device shipped directly by Trezor or a voucher. Affected individuals are asked to retain their existing hardware and contact support to arrange the replacement. The company has also stressed that scammers may contact customers via emails, letters or phone calls, and users must never disclose recovery phrases, including to anyone claiming to represent Trezor support.

Trezor Investigation and Future Steps

Trezor’s security team is arranging laboratory examination of the reported Safe 5 to determine the implant’s design and potential origins. Investigators have not yet identified the installer or confirmed whether the same group responsible for the Ledger devices was involved. The company continues collaborating with other parties and has engaged SEAL 911, the Security Alliance’s emergency response service, for customer guidance.

Trezor stated it is reviewing its hardware protections, noting that seals and packaging alone are not sufficient. The company has already reduced its reseller network following the incident and is working with Ledger on parallel investigations. No additional customer losses have been reported as of the announcement.