Trezor announced on Friday that it is treating a single customer report of a hardware implant in a Safe 5 wallet sold by former reseller CryptoBilis as credible, and is urging anyone who bought the device since March 2026 to transfer their funds to a new wallet with a fresh seed. The warning follows earlier reports of tampered Ledger devices sold through the same reseller, prompting Trezor to cut ties with CryptoBilis on Oct. 9.

Details of the alleged implant

According to the report shared by Trezor on X, the suspect device contains an added circuit board equipped with a cellular module. The implant is described as capable of capturing everything displayed on the wallet’s screen—including the recovery phrase—and transmitting that data over a mobile network once the device is plugged in. The company has not yet examined the unit, but the customer’s description matches the behavior observed in the Ledger implants disclosed earlier this month.

Company response and remediation steps

Trezor’s security team said it will analyze the Safe 5 once the device is received, and that no loss of funds has been reported by any CryptoBilis buyer to date. In the meantime, the firm is advising affected users to move their assets to a new hardware wallet or, if none is available, temporarily store funds in a trusted software wallet or exchange. Unopened devices should not be set up, and owners can contact Trezor support for a replacement. The company also noted that inspections of four other CryptoBilis‑origin wallets have so far revealed no signs of tampering.

Broader context and industry reaction

The incident revives concerns about the security of hardware wallets purchased through unauthorized channels. Earlier in October, Ledger confirmed a similar cellular implant in a device sold by CryptoBilis, with on‑chain analysis estimating over $86 million drained from affected Ledger users. Security researcher Joe Grand previously warned Trezor about counterfeit devices sold on TikTok and Facebook, prompting the firm to tighten its reseller network. Trezor announced plans on Oct. 13 to reduce its reseller base further, emphasizing that existing seals and packaging are insufficient safeguards against sophisticated tampering.

What to watch next

Follow Trezor’s forthcoming technical analysis of the Safe 5 unit once it arrives in the lab, and monitor any updates on additional compromised devices from CryptoBilis. Regulators may also scrutinize reseller practices after multiple hardware‑wallet manufacturers reported tampering incidents linked to the same seller.