{
  "id": "trezor-cryptobilis-implant",
  "url": "https://ohshit.app/incidents/trezor-cryptobilis-implant/",
  "title": "Trezor warns CryptoBilis buyers after a suspected Safe 5 hardware implant report",
  "level": 3,
  "level_name": "sharted",
  "date": "2026-10-30",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "Trezor",
    "hardware wallet",
    "supply chain"
  ],
  "ecosystems": [],
  "summary": "Trezor considers a Safe 5 implant report credible but has not examined the device. Buyers of any Trezor model supplied by CryptoBilis since March 2026 should move funds to a wallet with a fresh seed. No related customer losses have been reported to Trezor.",
  "splash": "Any Trezor model supplied by CryptoBilis since March 2026, including its Tokopedia store",
  "wipe": "Transfer funds to a newly created wallet with a new seed; restoring the old backup on another device does not remove the risk",
  "in_the_wild": "unknown",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Check the seller and move funds",
      "hint": "Check receipts for CryptoBilis supply. Use a secure replacement wallet with a fresh seed; if unavailable, Trezor suggests a familiar software wallet or exchange temporarily. Verify the entire receiving address."
    },
    {
      "title": "Avoid using an unconfigured device",
      "hint": "Do not set it up or enter an existing recovery phrase. Weighing or opening it cannot reliably establish safety."
    },
    {
      "title": "Arrange a replacement safely",
      "hint": "Keep the device and contact trezor.io/support for a replacement or voucher. Never disclose a recovery phrase to support or unsolicited messages."
    }
  ],
  "sources": [
    {
      "name": "Trezor security notice",
      "url": "https://trezor.io/blog/news/implant-reported-in-a-trezor-sold-by-cryptobilis",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "One credible implant report awaits laboratory confirmation; no losses reported to Trezor.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Oct 9, 2026",
      "title": "Trezor removes CryptoBilis as a reseller"
    },
    {
      "date": "Oct 28, 2026",
      "title": "Safe 5 buyer reports a suspected implant"
    },
    {
      "date": "Oct 30, 2026",
      "title": "Trezor warns buyers before laboratory confirmation"
    }
  ],
  "body_markdown": "The customer reports an added board between the main board and screen, using cellular connectivity to transmit displayed backups. Trezor has reviewed photos and interviewed the buyer; the device is still awaiting examination. The precaution covers all CryptoBilis-supplied models, rather than all Trezor wallets. L3 reflects a mainstream wallet warning; neither theft nor the reported mechanism is confirmed. No attacker identity is established."
}