Skip to content
NewA calmer, faster ZeroHour
StoryMalwarehigh

Trezor warns of suspected implant in CryptoBilis Safe 5

4 sources · 4 articlesFirst reported Updated ()1
What's new

October 30: BleepingComputer adds that Trezor has not received the device, calls the customer account unconfirmed, and tells buyers not to use the wallets. Holders with proof of purchase can request a replacement or voucher.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Trezor has not examined the reported Safe 5 and knows of no stolen funds, but tells CryptoBilis buyers since March 2026 not to use those devices.

Trezor warned on October 30 that a suspected implant in a Safe 5 bought in Indonesia from former reseller CryptoBilis could read a recovery phrase off the screen and transmit it over a mobile network. The customer bought the wallet on Tokopedia in August 2026 and contacted Trezor on October 28 with photos and a video. Trezor has not received the device for lab testing, finds the report believable, and knows of no related stolen funds. BleepingComputer says Trezor cited credible reports; other outlets describe one customer. The warning covers every Trezor model CryptoBilis supplied from March 2026; buyers should move funds to a new seed and may request a replacement or voucher.

Key facts
  • Purchase was on Tokopedia in August 2026; Trezor was contacted on October 28.
  • An extra board with a cellular module and antenna allegedly sits behind the screen.
  • Trezor removed CryptoBilis from its authorized reseller network on October 9.
  • Scope is every Trezor model CryptoBilis supplied from March 2026 onward.
  • GBHackers says four other CryptoBilis devices showed no modifications.
  • Do not enter an existing phrase on an unused device or open it to check.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 9, 2026Trezor removed CryptoBilis as an authorized reseller · Cyber Security News
  2. Oct 28, 2026Indonesian buyer reported the suspected Safe 5 implant · GBHackers
  3. Oct 30, 2026Trezor publicly warned CryptoBilis buyers since March 2026 · Cyber Security News

What each outlet adds

beyond the shared facts
  • The Hacker NewsRestoring an old phrase fails if it was already sent; do not open devices.
  • GBHackersFour other CryptoBilis devices examined showed no modifications.
  • BleepingComputerDevice not received; buyers told not to use the wallets.
  • Cyber Security NewsEligible buyers should keep the original wallet for a replacement or voucher.
Vendors
TrezorLedger
Products
Trezor Safe 5Safe 5
Organizations
CryptoBilisSingapore Police ForceLedgerSEAL_911SEAL 911Tokopedia
Countries
IndonesiaSingapore

Coverage

oldest first · one row per article · UTC
  1. · 14h ago Cyber Security NewsFirst report

    Trezor warns of suspected implant in CryptoBilis wallet

    One Indonesian Safe 5 buyer reported an extra board; Trezor has not lab-tested it and knows of no stolen funds.

  2. · 12h ago The Hacker News

    Trezor warns of suspected implant in Safe 5 sold by CryptoBilis

    Trezor has not lab-tested the device but tells CryptoBilis buyers since March 2026 to move funds to a new recovery phrase.

  3. · 12h ago GBHackers

    Trezor warns of suspected Safe 5 implant sold via CryptoBilis

    Trezor has not verified the device, and no CryptoBilis customer has reported lost funds to it.

  4. · 9h ago BleepingComputer

    Trezor warns of suspected theft implant in a Safe 5 wallet

    An Indonesian buyer found an extra cellular board in a CryptoBilis Safe 5; Trezor has not examined it.