Technologie & IA
Trezor warns of a suspected implant in a device sold by CryptoBilis
The manufacturer considers a report involving a Safe 5 credible, but has not yet examined the device in its laboratory. Its precautionary guidance covers purchases from the reseller since March 2026.
Olivia ParkerEditorial pen name
A credible report still awaits examination
On October 30, 2026, Trezor warned of a suspected hardware implant in a Safe 5 bought from CryptoBilis. The manufacturer says it received a report with photographs and interviewed the reporter by video. It nevertheless says the device has not yet arrived for laboratory examination. The warning therefore rests on a report considered credible and a precautionary response, rather than a completed hardware assessment or discovery of a general compromise affecting Trezor devices.
The reported case concerns a customer in Indonesia and a purchase through the reseller on Tokopedia. According to Trezor, no CryptoBilis buyer has reported device-related fund losses to the company at this stage. That wording describes information the company has received, rather than guaranteeing the condition of every wallet involved. Reporting a physical alteration, identifying how it operates, and establishing any theft are separate stages that must remain distinct.
The supply source defines the warning’s scope
Trezor’s guidance covers devices sourced through CryptoBilis from March 2026 onward, regardless of model, while the hardware report specifically concerns a Safe 5. The observed case and the precautionary scope therefore differ. The company says it removed CryptoBilis as an authorized reseller and continues investigating. It does not claim to have identified the same issue at every seller or in every region; extending its announcement that far would exceed the evidence published.
The manufacturer recommends that affected customers move assets to a newly created wallet with a new recovery backup. Reusing the backup from a potentially altered wallet on another device does not solve the described problem: it retains the same controlling secret. That recommendation must be attributed to Trezor and read within the alert’s scope. It does not mean the manufacturer has technically confirmed extraction of a backup from every device bought through the reseller.
Replacement does not remove the need for checks
Trezor’s transfer guide emphasizes choosing the right network and checking the destination address against its original source. These checks address a different risk from the suspected implant: a network mistake or substituted address can divert a transfer from its intended destination. The alert also says support never asks customers to disclose a recovery phrase. Replacement arrangements must therefore remain separate from any solicitation claiming to collect that secret on a customer’s behalf.
Trezor offers replacement options for purchases within its defined scope and asks customers to retain the device for support arrangements. Laboratory findings and identification of those responsible remain outstanding. The next decisive information will be confirmation or rejection of the reported mechanism and documentation of its scope. Meanwhile, the announcement establishes a supply-chain alert and targeted precautions; it does not establish that theft from Trezor users has already been demonstrated.