Trezor, a maker of hardware wallets for cryptocurrencies, announced on 30 October 2026 that it is examining a report of a hidden implant in a Trezor Safe 5. The device had been bought in August 2026 from CryptoBilis, a former authorised reseller in Southeast Asia. The manufacturer considers the report credible, but is waiting for the device to confirm it in the lab. No loss of funds has been reported to it.

A credible report, not yet confirmed

According to Trezor's statement, relayed by Journal du Coin, its security team received the report on 28 October 2026. It came in through the manufacturer's responsible disclosure programme.

The owner describes an electronic board added between the main board and the screen. It reportedly carries a cellular module and an antenna. According to his account, this device would read what is displayed, including the recovery phrase. It would then send it over the mobile network when the device is plugged in.

Trezor has photos and interviewed the customer by video call. Only laboratory analysis will be able to confirm these elements, however. The customer had already moved his funds before discovering the alleged implant.

The manufacturer says it has examined four other devices sourced from CryptoBilis, without detecting any tampering. It is in contact with Ledger and with SEAL 911, the crypto community's emergency response unit. It does not, however, attribute the incidents to the same perpetrators.

Mark Karpelès, former head of Mt. Gox, has relayed the alert. He is offering to cover the shipping costs of suspicious devices so that they can be analysed. This offer does not replace the examination Trezor is waiting for.

Which Trezor devices are affected?

As a precaution, the instructions cover all Trezor models bought from CryptoBilis since March 2026. They also apply to the shops this distributor supplied. The reported Safe 5 had been bought on Tokopedia, an Indonesian e-commerce platform. Trezor had removed CryptoBilis from its network of authorised resellers on 9 October 2026.

For these devices, the manufacturer gives four instructions:

  • Device already in use: quickly transfer the funds to a newly created wallet, with a new recovery phrase. Restoring the old phrase on another device is not enough if it has been intercepted.
  • No other trustworthy hardware wallet: temporarily use a software wallet or an exchange platform the user knows. Check the receiving address in full before the transfer.
  • Device still new: do not set it up and do not enter any existing phrase on it.
  • In all cases: keep the device and contact official support, which offers a replacement or a voucher covering the purchase of a new device.

Trezor points out that its support never asks for the recovery phrase. It also warns against fake messages that might exploit the incident.

Ledger, Trezor, Keystone: three alerts in a month

The Trezor alert follows two other hardware wallet cases, which 2clics covered in October 2026. The first concerns Ledger, another hardware wallet maker, whose rigged devices were sold by CryptoBilis. The second involves Keystone, a hardware wallet maker unrelated to the Swiss news agency Keystone-ATS.

ManufacturerWhat is at issueStatusFunds
LedgerComponents grafted into genuine devices, resold in Southeast AsiaConfirmed by Ledger, which speaks of a "localised attack on distribution"$102 million drained from 324 wallets according to Bitquery as of 15 October, a figure neither confirmed nor disputed by Ledger
TrezorAn alleged implant in a Safe 5 bought from CryptoBilisReport deemed credible, laboratory analysis pendingNo loss reported to the manufacturer
KeystoneTheft of the key that authenticates the devices, after an intrusion into the online shopAnnounced by Keystone on 26 October 2026Funds not exposed according to Keystone; 18,835 devices in stock destroyed

According to Ledger, a "highly organised criminal group" opened genuine devices to add components to them. The manufacturer states that its chip, its operating system and its servers remained intact. At Trezor, nothing of the kind has been established at this stage: a single credible report, without laboratory confirmation.

What buyers in Switzerland should check

None of the sources mentions any affected Trezor device in Switzerland. CryptoBilis operated as an authorised reseller in Indonesia, Malaysia and the Philippines, according to the information reported by 2clics in the Ledger case. As things stand, a buyer in Switzerland is only concerned if their device comes from this distributor.

The purchase channel

Where the stock comes from matters as much as the seller's name. Trezor's instructions indeed also cover the shops supplied by CryptoBilis. Our analysis: a device bought second-hand or on a marketplace, with no known provenance, deserves the same precautions. Ledger, for its part, says that its checks in shops and warehouses in Europe found no modified units.

The seals and the casing

Packaging that looks intact is not enough to be reassuring. Trezor advises against weighing the device or opening the casing: in its view, these checks cannot rule out tampering. In the Ledger case, moreover, the rigged devices were genuine devices that had been opened and then put back into circulation.

The authenticity check

The authenticity check is done in the manufacturer's official app, never on a page received by email. After the Ledger implants, a phishing campaign imitated precisely this check to demand the 24 words, according to the security firm SlowMist. The Keystone case shows another limit: with the stolen key, a clone could pass the test on the official website, Journal du Coin explains.

For the security of a crypto wallet, one rule holds whatever the model. Ledger puts it this way: the recovery phrase is only ever entered on the device, never on a computer, a phone or a web page. Neither Trezor nor Ledger asks for it through their support.

What we don't know yet

  • Whether laboratory analysis will confirm the added board described by the owner.
  • How many Trezor devices CryptoBilis has sold since March 2026: the statement gives no figure.
  • Whether the Ledger and Trezor incidents have the same perpetrators: Trezor does not attribute them to the same perpetrators.
  • Whether Trezor's authenticity check would have spotted a board added between the main board and the screen: the statement says nothing about it.
  • Whether modified Trezor devices have circulated outside Southeast Asia.

Sources