Trezor Warns of Possible Spy Implant in Safe 5

Trezor warned customers who purchased hardware wallets from former reseller CryptoBilis since March 2026 about a suspected malicious implant in the Safe 5 device. The company received a report on October 28, 2026, from a user in Indonesia who bought the wallet in August through the Tokopedia marketplace.

What was found

According to the owner's description, there is an additional circuit board with a cellular modem and antenna located between the main board and the device's screen. It is presumed that it could read the displayed information, including the recovery phrase, and transmit it over the mobile network when connected to power. Trezor examined photos and conducted a video interview with the client, but has not yet received the device itself: the company is preparing a laboratory examination. Despite this, the report was considered credible enough to issue a warning. The client had already transferred cryptocurrency from the device before discovering the board. No losses among buyers of devices from CryptoBilis have been recorded by the company.

Context with Ledger

On October 9, Trezor removed CryptoBilis from the list of authorized resellers following reports of modified Ledgers sold through the same supplier. By October 19, Trezor received four wallets from CryptoBilis – two Safe 5, Safe 7, and Safe 3 – and found no signs of tampering in them. The current case involves a separate Safe 5, which was not part of those checks. Investigators have not yet determined who installed the implant or if it is related to the attack on Ledger.

The bigger picture

On October 29, Arkham Intelligence traced $95.35 million in suspected thefts from 1,486 addresses during October 7–9; about 10 million USDT was frozen. Singapore police reported losses of S$3.5 million in two cases involving modified Ledgers from local stores. Bitquery estimated the damage from the Ledger incident at $93.2 million, a figure not confirmed by the manufacturer. According to Chainalysis, one of the largest victims was the scammer himself, who lost 60 BTC (about $4.8 million).

Recommendations

Customers who purchased Trezor from CryptoBilis since March 2026 are advised to transfer funds to a new wallet with a new seed phrase as soon as possible: restoring the old phrase on another device does not eliminate the risk. If another hardware wallet is unavailable, a familiar software wallet or exchange can be used temporarily, checking recipient addresses. Unactivated devices should not be set up, and entering an existing phrase on them is also not recommended. Opening or weighing wallets is not advisable: the weight difference does not provide a reliable result, although the claimant noticed it. The warning applies to all Trezor models from CryptoBilis, including those sold through Tokopedia and other stores. Affected customers are offered a replacement device from Trezor or a voucher; the current wallet should be retained and support contacted. Trezor reminded of the risk of fraud and asked never to disclose the recovery phrase. The investigation is ongoing in collaboration with Ledger and the SEAL 911 service.