Hardware wallet maker Trezor said Friday it received a credible report of a suspected hardware implant in a Trezor Safe 5 sold by CryptoBilis, a former authorized reseller in Southeast Asia, and told customers who bought devices from that seller since March 2026 to move their funds^1,2.

The company has not examined the device and said it has not confirmed the implant, according to coverage of its blog post^1,2.

The report came from a customer in Indonesia who bought the Safe 5 from CryptoBilis through Tokopedia in August 2026, The Hacker News and BleepingComputer reported, citing Trezor^1,2.

The customer described an extra circuit board between the wallet's main board and screen, with a cellular module and antenna^1,2.

Based on that unconfirmed account, the implant appeared able to read information on the screen, including the recovery phrase, and send it over a mobile network when the device was plugged in^1,2.

Trezor said it had photos, a description and a video interview with the customer and was arranging for the wallet to be sent to its lab^1,2.

Trezor told CryptoBilis buyers since March 2026 not to set up unused devices and, if already using one, to move funds to a newly created wallet with a new recovery phrase rather than restoring the old phrase^1,2.

Buyers with proof of purchase may contact Trezor for a replacement device or a voucher, BleepingComputer reported².

Trezor said it was unaware of any funds stolen from its customers in a supply-chain attack².

CryptoBilis was the same retailer implicated in a Ledger implant case earlier this month; Trezor stopped selling through CryptoBilis on Oct. 9, 2026, after Ledger began investigating losses among its own customers^1,2.

BleepingComputer noted Singapore police separately described tampered Ledger wallets and additional losses; that advisory concerned Ledger devices, not Trezor².

Trezor said it would update its notice after examining the device and that weighing a wallet is not a reliable way to detect tampering².