EN Trezor warns CryptoBilis buyers after Safe 5 implant report
Contents
At a glance
Trezor has warned buyers of a reported Safe 5 hardware implant. Its lab has not examined the device; the precaution covers purchases through CryptoBilis from March 2026.
Who the warning covers
Trezor issued a warning on 30 October 2026 after receiving a customer's report of a possible hardware implant inside a Safe 5 purchased through CryptoBilis. The manufacturer had not received the device for laboratory examination when it published the notice. It says no CryptoBilis buyer had reported a loss of funds to it.
The precaution applies to every Trezor model supplied by CryptoBilis from March 2026 onwards, including its Tokopedia store. Buyers can check the seller on their receipt or contact official support if the supply route is unclear. The warning does not establish that every device from that seller was altered.
What remains unconfirmed
The report reached Trezor on 28 October and concerns a device bought in August. It describes an additional circuit board between the main board and screen, allegedly transmitting displayed information over a cellular connection. Trezor treats the report as credible but has not verified that mechanism itself.
The company says it does not know who is responsible. The notice therefore supplies no basis for accusing the reseller of installing the alleged component or identifying a shared attacker with another incident.
A new backup, not just another device
For covered devices already holding assets, Trezor recommends moving funds to a newly created wallet with a new recovery phrase. Restoring the existing backup on another device would leave the same backup in use. Unused devices should not be set up or receive an existing backup. Keep the device and contact Trezor through its official support route about a replacement or voucher.
This is a precautionary response to an unresolved report. It is not confirmation that the manufacturer's production systems or every Safe 5 has been compromised.
Checks before moving assets
Trezor's separate sending guide explains that the receiving address must support the chosen asset and network. Obtain it from the intended destination, rather than copying an apparent previous recipient from transaction history. Check any required destination tag or memo as well as the address.
Before broadcasting, review the recipient, amount and network fee. After a transfer, its inclusion and confirmation status can be checked in the transaction history or a block explorer. These ordinary transfer checks help avoid sending mistakes; they cannot independently diagnose the reported hardware implant.
Evidence & sources
Source record: · Checked:
Record limits · Checked on 31 October 2026. The implant remains a customer report awaiting Trezor laboratory examination; no loss reported to the company is not proof that no loss occurred.
- Source reported
Trezor warned CryptoBilis buyers after a customer report; laboratory confirmation and reported losses remain unresolved.
Supporting excerpt: Trezor: implant reported in a device sold by CryptoBilis
No CryptoBilis buyer has reported a loss of funds to us.
Trezor: implant reported in a device sold by CryptoBilis ↗Supporting excerpt: Trezor: implant reported in a device sold by CryptoBilis
Our security team will examine the device as soon as it arrives.
Trezor: implant reported in a device sold by CryptoBilis ↗ - Source reported
Trezor recommends a new wallet backup and official replacement support for covered buyers.
Supporting excerpt: Trezor: implant reported in a device sold by CryptoBilis
Using the wallet backup generated by the tampered wallet on another device does not solve the issue.
Trezor: implant reported in a device sold by CryptoBilis ↗ - Source reported
Trezor's sending guidance requires the correct network and recipient checks.
Supporting excerpt: Trezor Suite: sending crypto
Each account in Trezor Suite corresponds to one network, and it can only send on that network.
Trezor Suite: sending crypto ↗
Related reading
Fake exchange support: how to verify a request
Verify an exchange support request and protect your account if you shared a code, allowed remote access or sent cryptocurrency.
Read article : Fake exchange support: how to verify a request
Why a hardware wallet cannot make a dangerous token approval safe
Keeping keys offline reduces key-theft risk. It does not cancel permissions you sign: approval scope and readable transaction details remain separate safeguards.
Read article : Why a hardware wallet cannot make a dangerous token approval safe
KuCoin’s regional exit: what it means for withdrawals
KuCoin is ending services in Russia and Belarus. We separate account eligibility, completed withdrawals and solvency, and identify what the announcement does not establish.
Read article : KuCoin’s regional exit: what it means for withdrawals