Trezor advised clients who acquired hardware wallets via the distributor CryptoBilis starting in March 2026 to transfer their assets right away, following a responsible vulnerability report claiming a physical modification inside a Safe 5 unit.
The Czech manufacturer of hardware wallets expelled CryptoBilis from its authorized vendor list earlier this month subsequent to reports involving compromised Ledger units distributed by the same vendor.
In an online journal entry posted on Friday, Trezor stated it obtained the notification on October 28 concerning a product acquired in August 2026 through Tokopedia. The business has not yet obtained the hardware for a thorough investigation, though it conducted a video interview with the buyer and is treating the warning as trustworthy, the firm added.
“We would rather caution individuals now than wait for verification and discover someone suffered a loss of funds meanwhile,” remarked Trezor Chief Commercial Officer Danny Sanders in a message to The Block. “Should you have purchased a Trezor from CryptoBilis since March, transfer your funds to a fresh wallet and reach out to our Support department, and we will dispatch a replacement unit.”
Based on the publication, the alleged modification consists of an extra circuit board positioned between the primary board and the display of the gadget. It incorporates a cellular component and antenna capable of capturing details shown on the display, such as a wallet backup phrase, and sending it across a cellular network.
Trezor stated it initiated examinations of products bought from the vendor after cutting ties with them. The organization has taken in four customer devices for analysis thus far and noted it detected no evidence of interference in those specimens.
Increasing Security Concerns
Competing wallet producer Ledger previously validated physical interference in signing tools distributed by CryptoBilis, while OneKey similarly terminated connections with the reseller, paused fresh approvals, and supplied complimentary swaps.
As for Trezor, no user asset loss has been documented. Onchain researchers estimated losses linked to the Ledger event exceeding $86 million across Bitcoin, Ethereum, and Tron, though the wallet creator has not verified those amounts.
Meanwhile, the CryptoBilis situation is not the sole security challenge for Trezor this year. In August, an incident at logistics partner ShipMonk compromised personal information belonging to approximately 13,700 users.
In September, Trezor revealed that another roughly 67,000 U.S. customers experienced impacts from the identical incident. Additionally in the same month, the enterprise stated a breach at its external email vendor had permitted phishing communications to go out utilizing Trezor’s official domain.
Originally published at https://www.theblock.co/news/ecosystems/2026-10-30-trezor-reports-suspected-hardware-implant-432196.
