Skip to content
EVENT / TOPICActive

Trezor Warns CryptoBilis Buyers of Possible Hardware Implant in Safe 5

3 reports3 sources10/30/2026 updated

Current overview (not historical)

AI overview

Trezor has announced that a suspected hardware implant was found inside the Safe 5 hardware wallet sold by CryptoBilis, urging users to move their funds. The company cited a credible report that the device contains an unauthorized circuit board, which could capture information displayed on the screen—including recovery phrases—and transmit it via a cellular network. CryptoBilis customers who purchased Safe 5 units since March are specifically advised to migrate their assets. An Indonesian customer also reported finding a similar unauthorized board in a Safe 5 bought on Tokopedia in August, reinforcing Trezor’s warning that the implant could compromise user security.

Written with AI from the reporting · updated 10/30/2026

EventGraph Explorer

One time cutoff for reports, relations and evidence.

EVENTGRAPH EXPLORER
Open in the standalone explorer ↗
EVENT REPLAYStep 3 / 3

New at this step ·Trezor Warns Safe 5 Owners Who Bought From CryptoBilis About Possible Hardware Implant

Reports in replay
3
First-party
0
Sources
3

Discovery-time replay; the linked graph and evidence share this cutoff. The full overview and activity remain current.

Event developments

1 developments
  1. 10/30/2026, 6:27:13 PM

    Trezor Warns Safe 5 Owners Who Bought From CryptoBilis About Possible Hardware Implant

    Decrypt

Filtered by first discovery; only representative reports already discovered by this cutoff are shown. Story grouping may have changed later, so this is not a complete historical snapshot.

Bounded reconstruction, not an exact snapshot: entity names, relationship text and story grouping may include later revisions. Overview and full source archive below remain current.

Story route

A station-by-station route from the first public evidence onward; every station carries its own evidence and uncertainty.

  1. 1Oct 30, 00:00recorded Oct 30, 17:02revised

    Trezor reports suspected hardware implant in Safe 5 sold by

    Read original source ↗ The BlockReplay this moment in the explorer

Uncertainty marks flag where to check the sources; they are not proven causation.

Full source archive (current)

Current public reports; outside the historical replay.

First-party sources · 0 reports

No verifiable reports in this group yet.

Independent coverage · 3 reports

  • Decrypt · Oct 30, 18:07
    Trezor Warns Safe 5 Owners Who Bought From CryptoBilis About Possible Hardware Implant

    Trezor said it received a credible report that a hardware implant was found inside a Safe 5 wallet purchased from Indonesian reseller CryptoBilis in August 2026. The implant, described as an extra circuit board with a cellular module and antenna placed between the main board and the screen, allegedly reads the screen—including the wallet’s backup phrase—and transmits it over a mobile network when the device is plugged in. Trezor has not yet examined the device but has treated the report as credible based on the customer’s description and a video interview. The company urged anyone who bought a Trezor wallet from CryptoBilis since March 2026 to move funds to a new wallet with a new recovery phrase and not to reuse the old phrase on any device. No CryptoBilis buyer has reported a loss of funds to Trezor. The incident follows Ledger’s own investigation of similar implants in devices sold through CryptoBilis. Trezor removed CryptoBilis as a reseller on October 9 after the incident.

    Read original source ↗
  • Cointelegraph · Oct 30, 17:26
    Trezor Urges Safe 5 Buyers to Move Funds After Report of Unauthorized Implant

    Trezor has warned customers who purchased its Safe 5 hardware wallets from the former authorized reseller CryptoBilis since March to transfer their funds. The warning follows a report from an Indonesian customer who found an unauthorized circuit board inside a Safe 5 bought on Tokopedia in August. The suspected implant could capture screen‑displayed data, including wallet recovery phrases, and transmit it via a cellular network. Trezor’s chief commercial officer, Danny Sanders, said the company had not yet examined the device but treated the report as credible and preferred to warn users pre‑emptively. While Trezor has not confirmed where the tampering occurred, it acknowledged that its existing safeguards—such as seals and packaging—are not sufficient alone. The alert comes after similar incidents involving Ledger wallets sold through CryptoBilis, where an unauthorized implant was confirmed. Trezor has been reviewing its hardware protections and plans to reduce its reseller network.

    Read original source ↗
  • The Block · Oct 30, 16:55
    Trezor Warns CryptoBilis Customers to Move Funds After Report of Hardware Implant in Safe 5

    Trezor has issued a warning to users of the Safe 5 hardware wallet sold by CryptoBilis, after receiving a credible report that a hardware implant was found inside the device. The company urges affected customers to migrate their funds to a different wallet to avoid potential theft. The alert highlights the risk that the implant could compromise the security of the Safe 5 and potentially allow unauthorized access to stored cryptocurrencies.

    Read original source ↗

Different reports do not necessarily disagree. Check original sources and publication dates.

Report timeline

Explore every side through dated source reports.

Oct 30
  1. Decrypt
    Trezor Warns Safe 5 Owners Who Bought From CryptoBilis About Possible Hardware Implant

    Trezor said it received a credible report that a hardware implant was found inside a Safe 5 wallet purchased from Indonesian reseller CryptoBilis in August 2026. The implant, described as an extra circuit board with a cellular module and antenna placed between the main board and the screen, allegedly reads the screen—including the wallet’s backup phrase—and transmits it over a mobile network when the device is plugged in. Trezor has not yet examined the device but has treated the report as credible based on the customer’s description and a video interview. The company urged anyone who bought a Trezor wallet from CryptoBilis since March 2026 to move funds to a new wallet with a new recovery phrase and not to reuse the old phrase on any device. No CryptoBilis buyer has reported a loss of funds to Trezor. The incident follows Ledger’s own investigation of similar implants in devices sold through CryptoBilis. Trezor removed CryptoBilis as a reseller on October 9 after the incident.

  2. Cointelegraph
    Trezor Urges Safe 5 Buyers to Move Funds After Report of Unauthorized Implant

    Trezor has warned customers who purchased its Safe 5 hardware wallets from the former authorized reseller CryptoBilis since March to transfer their funds. The warning follows a report from an Indonesian customer who found an unauthorized circuit board inside a Safe 5 bought on Tokopedia in August. The suspected implant could capture screen‑displayed data, including wallet recovery phrases, and transmit it via a cellular network. Trezor’s chief commercial officer, Danny Sanders, said the company had not yet examined the device but treated the report as credible and preferred to warn users pre‑emptively. While Trezor has not confirmed where the tampering occurred, it acknowledged that its existing safeguards—such as seals and packaging—are not sufficient alone. The alert comes after similar incidents involving Ledger wallets sold through CryptoBilis, where an unauthorized implant was confirmed. Trezor has been reviewing its hardware protections and plans to reduce its reseller network.

  3. The Block
    Trezor Warns CryptoBilis Customers to Move Funds After Report of Hardware Implant in Safe 5

    Trezor has issued a warning to users of the Safe 5 hardware wallet sold by CryptoBilis, after receiving a credible report that a hardware implant was found inside the device. The company urges affected customers to migrate their funds to a different wallet to avoid potential theft. The alert highlights the risk that the implant could compromise the security of the Safe 5 and potentially allow unauthorized access to stored cryptocurrencies.

Event activity trend

Latest comparable
15
Comparable peak
2910月30日 19:00
24h change
–

The chart compares consistently observed participants only. Hover or tap to inspect each hour; use arrow keys to move between observations.