---
title: Trezor tells anyone who bought a Trezor from former reseller CryptoBilis since March 2026 to move funds to a new seed after a reported cellular implant in a Safe 5 | ctxsec
url: https://ctxsec.com/items/trezor-safe-5-cryptobilis-reported-cellular-implant
description: ""
status: "official warning (Trezor blog, Oct 30); the implant itself is reported by a customer and not yet examined by Trezor"
published: 2026-10-30
---

> 

[← Cybersecurity News](/news) · [markdown](/items/trezor-safe-5-cryptobilis-reported-cellular-implant.md)

official warning (Trezor blog, Oct 30); the implant itself is reported by a customer and not yet examined by Trezor

2026-10-30

### Trezor tells anyone who bought a Trezor from former reseller CryptoBilis since March 2026 to move funds to a new seed after a reported cellular implant in a Safe 5

Trezor says it received a responsible-disclosure report on **Oct 28** of a hardware implant in a **Trezor Safe 5** bought in August 2026 from **CryptoBilis** via Tokopedia. CryptoBilis was an authorized Trezor reseller in Southeast Asia until Trezor removed it on Oct 9, after Ledger began investigating tampered Ledger devices sold through the same reseller. The report describes an extra circuit board between the main board and screen, with a cellular module and antenna, that reads what the screen shows, including the recovery phrase, and sends it over a mobile network when the device is powered.

Trezor has **not yet received the device** to confirm this, but says it is treating the report as credible based on the customer's description and a video interview. No CryptoBilis buyer has reported a loss to Trezor; The Block reports Trezor found no tampering in four devices returned so far.

**Do now if you bought from CryptoBilis since March 2026:** move funds to a newly created wallet with a _new_ seed (restoring the old backup on another device does not help); if the device is unopened, do not set it up. Trezor offers a free replacement. Expect phishing that uses this incident; Trezor support never asks for a recovery phrase.

Sources: [Trezor: Implant reported in a Trezor sold by CryptoBilis (Oct 30)](https://trezor.io/blog/news/implant-reported-in-a-trezor-sold-by-cryptobilis) · [The Block: Trezor reports suspected hardware implant in Safe 5 sold by CryptoBilis](https://www.theblock.co/news/ecosystems/2026-10-30-trezor-reports-suspected-hardware-implant-432196)