The supply chain scare around Southeast Asian reseller CryptoBilis has now reached Trezor. The hardware wallet maker published a security notice after a customer in Indonesia reported a hardware implant inside a Trezor Safe 5 bought from CryptoBilis via Tokopedia in August 2026.

The report describes an extra circuit board fitted between the main board and the screen, with a cellular module and an antenna. It allegedly reads what the screen shows, including the wallet backup, and sends it out over a mobile network when the device is plugged in. Trezor has not examined the device yet but treats the report as credible, saying the implant appears to work similarly to those found in tampered Ledger devices.

Anyone who bought a Trezor from CryptoBilis from March 2026 onwards is told to move funds to a new wallet with a new seed, and is eligible for a replacement device or voucher.

No loss of funds has been reported so far. CryptoBilis was removed as an authorized Trezor reseller on October 9, the day Ledger began investigating losses among its own CryptoBilis customers. Trezor also warns that scammers will likely exploit the incident with phishing emails, letters and calls.