Trezor Warns of a Suspected Spy Implant Inside a Safe 5 Wallet Sold by Third-Party Reseller CryptoBilis
A Circuit Board That Should Not Be There
Trezor disclosed on October 30, 2026, that it received a credible report of a suspected hardware implant inside a Trezor Safe 5 device purchased from former authorised reseller CryptoBilis. The report came from a customer in Indonesia who bought the device through Tokopedia in August 2026 and submitted the disclosure on October 28. The customer had already moved their funds before discovering the suspected modification.
According to the customer’s report, an additional circuit board was installed between the Safe 5’s main board and its screen, accompanied by a cellular module and antenna. The implant reportedly captures the recovery phrase displayed on the screen during wallet setup and transmits it over a mobile network to the attacker. If confirmed, the attacker would have full access to every Bitcoin held in wallets set up on that device.
CryptoBilis Was Already Under Suspicion
CryptoBilis is the same Southeast Asian reseller implicated in a separate Ledger hardware implant incident that surfaced earlier in October. Ledger began investigating customer fund losses on October 9 and later confirmed physical tampering in some devices sold through CryptoBilis. Trezor immediately removed CryptoBilis from its authorised reseller network, before it had any indication its own devices were affected. The Safe 5 report arrived 19 days later.
Trezor has not yet received the device for physical examination and has not confirmed the implant independently. No CryptoBilis customer has reported stolen funds to Trezor in connection with this incident. But the company issued its warning before laboratory confirmation to give potentially affected users time to secure their assets. Trezor’s advisory covers anyone who purchased any Trezor model from CryptoBilis from March 2026 onward.
What This Means for Self-Custody in Africa
For Bitcoin holders across Africa who rely on hardware wallets as the foundation of their self-custody setup, the CryptoBilis incident is a direct warning about supply chain risk. A hardware wallet is only as trustworthy as the path it took to reach you. Buying from unofficial resellers, marketplace sellers, or third-party shops introduces a gap between the manufacturer and the user where physical tampering can happen. Trezor’s own advice is clear: buy directly from the manufacturer or from authorised resellers whose supply chains you can verify.