Trezor has received a report of a hardware implant inside a Trezor Safe 5 bought from CryptoBilis, the same Southeast Asian reseller behind the tampered Ledger wallets. The device was bought in August 2026. Trezor hasn’t inspected it yet, but it is treating the report as credible. Its advice for anyone who bought a Trezor from CryptoBilis since March 2026 is clear: move your funds to a new seed now.
The timing hurts. The industry is still digesting the Binance hack post mortem, and now the CryptoBilis story reaches a second wallet brand. Here’s what Trezor said, what to do and how I see it.
What Trezor Found
Trezor learned about the device through its responsible disclosure program. A customer reported a single hardware implant inside a Trezor Safe 5 bought from CryptoBilis in August 2026. The security group SEAL 911 is working alongside Trezor’s team on the response.
A few details matter here:
- Unconfirmed so far. Trezor hasn’t received the device yet. Its security team will examine it as soon as it arrives.
- No losses reported. So far, no CryptoBilis buyer has reported lost funds to Trezor.
- Four clean devices. Since cutting CryptoBilis on October 9, Trezor has inspected four devices bought there. None showed signs of tampering.
Even so, Trezor chose to warn customers before confirming the case. Given what happened to Ledger buyers, that’s the right call.
What to Do If You Bought a Trezor From CryptoBilis
Trezor’s guidance covers anyone who bought a device from CryptoBilis from March 2026 onwards.
Already using it?
- Move your funds to a newly created wallet with a brand-new seed as soon as possible.
- Never reuse the old seed in any wallet, hardware or software.
- No other secure hardware wallet at hand? Trezor suggests temporarily moving funds to a software wallet or an exchange you know.
Not set up yet?
- Don’t set it up.
- Never enter your existing wallet backup on it.
If you’re affected, keep the CryptoBilis device and contact Trezor Support through its official site. Trezor says it will send you a new hardware wallet. As always, nobody from Trezor will ever ask for your recovery phrase.
One honest note on the exchange option. After the Binance hack this week, I’d treat that strictly as a short stop, not a home for your coins.
Why March 2026 Matters
Trezor’s warning window starts in March 2026. Ledger asked its CryptoBilis buyers to look back only 90 days, so this window runs much further.
The month stands out for another reason. As we reported, CryptoBilis changed hands in March 2026, months before the Ledger drains started. Trezor hasn’t linked its window to the sale. Still, the overlap is hard to ignore.
The bigger picture keeps growing, too. It started with the Ledger CryptoBilis warning on October 9. A few days later, MediaMarkt pulled Ledger wallets across Europe after a buyer reported implants. Now a Trezor enters the picture.
How the Implant Works in the Ledger Cases
Trezor hasn’t described the implant in its own case yet. However, the confirmed Ledger cases show how this attack works.
Researchers found a small board hidden inside the device, fitted with an antenna and a SIM card. It reads the recovery phrase while you set up the wallet. Then it sends those words to the attacker over a cellular network.
That makes the attack patient. The thief doesn’t need to act right away. Instead, they can wait until the wallet holds enough to be worth emptying.
Worse, standard authenticity checks may not catch it. They verify the secure chip, not every extra part someone squeezed in around it.
Is Trezor Still Safe?
Nothing so far points to a flaw in Trezor’s own chip, firmware or factory. Like the Ledger cases, this is a supply chain problem. Someone touched the device between the maker and the buyer.
Trezor was already tightening up before this report. Earlier this month, it started cutting back its reseller network, with selected partners losing authorization from January 1, 2027.
For the full picture on the device itself, read our take on whether Trezor is safe. My short answer: a Trezor bought straight from Trezor still looks safe to me. One that passed through a middleman needs a closer look.
My Own Trezor Check
I’ve only ever bought hardware wallets directly from the manufacturer’s website. Still, when the MediaMarkt reports came out, I opened my Ledgers and my Trezor to check. Both were clean, and that was a relief.
If you bought from any reseller, store or marketplace, do the same today. Opening a device can void your warranty, so take your time. Anything odd inside, like an extra board, cable or SIM, means you stop using it right away.
My rule hasn’t changed. Buy direct, generate your own seed and move fast when something looks off.
Keep This Content Free
Tracking a supply chain attack across two wallet brands takes hours of reading and checking, and we keep all of it free. If this post helped you, consider signing up through our OKX link or our Bybit link. You pay nothing extra.
Final Words
One reported implant isn’t a confirmed case yet. Still, Trezor is right to warn first and inspect second. If you bought a Trezor from CryptoBilis since March 2026, move your funds to a new seed now and contact support for a replacement.
The CryptoBilis story keeps spreading, and it probably isn’t over. We’ll update this post as soon as Trezor shares the results of its inspection.
FAQ
Was a Trezor found with an implant?
A customer reported a hardware implant in a Trezor Safe 5 bought from CryptoBilis in August 2026. Trezor hasn’t inspected the device yet, but it’s treating the report as credible.
Which Trezor buyers are affected?
Anyone who bought a Trezor from the reseller CryptoBilis from March 2026 onwards should take action. Devices bought directly from Trezor are not part of this warning.
What should I do if I bought a Trezor from CryptoBilis?
If you use it, move your funds to a new wallet with a new seed and never reuse the old one. If it’s unused, don’t set it up. Either way, contact Trezor Support for a new device.
Has anyone lost funds?
Not so far. Trezor says no CryptoBilis buyer has reported a loss of funds.
Is CryptoBilis still a Trezor reseller?
No. Trezor removed CryptoBilis as a reseller on October 9, 2026, after reports of tampered Ledger devices.
Is Trezor itself hacked?
No. Nothing points to Trezor’s own chip, firmware or production. The risk comes from tampering on the route to the buyer.
Credit: Source link
