Trezor warns CryptoBilis buyers after a suspected Safe 5 hardware implant report
Trezor considers a Safe 5 implant report credible but has not examined the device. Buyers of any Trezor model supplied by CryptoBilis since March 2026 should move funds to a wallet with a fresh seed. No related customer losses have been reported to Trezor.
- Disclosed
- Oct 30, 2026
- Public disclosure date
- Severity
- Sharted
- No CVE: a breach, not a bug
- Splash zone
- Any Trezor model supplied by CryptoBilis since March 2026, including its Tokopedia store
- Trezor · hardware wallet · supply chain
- In the wild
- Unknown
- One credible implant report awaits laboratory confirmation; no losses reported to Trezor.
What happened
The customer reports an added board between the main board and screen, using cellular connectivity to transmit displayed backups. Trezor has reviewed photos and interviewed the buyer; the device is still awaiting examination. The precaution covers all CryptoBilis-supplied models, rather than all Trezor wallets. L3 reflects a mainstream wallet warning; neither theft nor the reported mechanism is confirmed. No attacker identity is established.
Crime-scene timeline
Oct 9, 2026
Trezor removes CryptoBilis as a reseller
Oct 28, 2026
Safe 5 buyer reports a suspected implant
Oct 30, 2026
Trezor warns buyers before laboratory confirmation
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Trezor security noticePrimary