Trezor says it received a responsible-disclosure report on Oct 28 of a hardware implant in a Trezor Safe 5 bought in August 2026 from CryptoBilis via Tokopedia. CryptoBilis was an authorized Trezor reseller in Southeast Asia until Trezor removed it on Oct 9, after Ledger began investigating tampered Ledger devices sold through the same reseller. The report describes an extra circuit board between the main board and screen, with a cellular module and antenna, that reads what the screen shows, including the recovery phrase, and sends it over a mobile network when the device is powered.

Trezor has not yet received the device to confirm this, but says it is treating the report as credible based on the customer's description and a video interview. No CryptoBilis buyer has reported a loss to Trezor; The Block reports Trezor found no tampering in four devices returned so far.

Do now if you bought from CryptoBilis since March 2026: move funds to a newly created wallet with a new seed (restoring the old backup on another device does not help); if the device is unopened, do not set it up. Trezor offers a free replacement. Expect phishing that uses this incident; Trezor support never asks for a recovery phrase.