Trezor Treats One Report of an Implanted CryptoBilis Safe 5 as Credible Before Examining It

Introduction

A customer who purchased a Trezor Safe 5 from the now‑discontinued reseller CryptoBilis reported a suspected hardware implant. Although Trezor has not yet examined the unit, the company has publicly deemed the claim credible and is taking precautionary steps to protect users who bought wallets through that channel.

Why Trezor Is Treating the Report as Credible

Trezor’s security team flagged the report through its responsible disclosure program. The customer described an additional circuit board with a cellular module that could capture screen data—including the recovery phrase—and transmit it over a mobile network. This description mirrors previously documented implants found in compromised Ledger devices sold by CryptoBilis. While no physical evidence has been confirmed, the similarity of the alleged implant to known threats prompted Trezor to err on the side of caution and share the warning with the broader community.

What Trezor Has Done So Far

• Reseller removal: On Oct. 9, Trezor cut ties with CryptoBilis after earlier reports of tampered Ledger wallets sold through the same channel.
• Device inspections: The company has received four other Safe 5 units from CryptoBilis customers and found no signs of tampering in any of them.
• Public advisory: Trezor posted on X, urging anyone who bought a Safe 5 from CryptoBilis after March 2026 to move their funds to a new wallet with a fresh seed and to avoid re‑using the old seed on any device or app.
• Support options: Users with an unopened device should not set it up. Those who have already activated a wallet are advised to transfer assets to a secure hardware wallet or a trusted software wallet/exchange temporarily. Affected customers can keep the suspect unit and contact Trezor Support for a replacement.

Practical Steps for Affected Users

1. Identify the purchase date and reseller – Verify whether the wallet was bought from CryptoBilis on or after March 2026.
2. Do not power on or set up the device – If the wallet is still sealed, leave it untouched.
3. Create a new seed – Use a trusted hardware wallet (e.g., a fresh Trezor or another reputable brand) to generate a new recovery phrase.
4. Transfer funds immediately – Move all assets from the potentially compromised wallet to the new seed. If you lack a second hardware wallet, a reputable software wallet or exchange can serve as a temporary holding place.
5. Contact Trezor Support – Report the device and request a replacement; provide any details that may aid the investigation.

Looking Ahead

Trezor’s security team plans to examine the reported Safe 5 once it arrives. The outcome will determine whether the alleged implant was a genuine threat or a false alarm. In the meantime, the incident underscores the importance of buying hardware wallets directly from manufacturers or authorized distributors and staying vigilant about supply‑chain risks.

--- This article is based on publicly available statements from Trezor and does not contain any unverified claims or proprietary data.