An extra circuit board with a cellular module and antenna was found inside a Trezor Safe 5 purchased on Tokopedia in August 2026, according to the company’s report of the incident.
The Safe 5 device and the reported implant
Trezor, maker of physical cryptocurrency wallets that store private keys and authorize transactions, says it has received credible reports that a Safe 5 device sold by reseller CryptoBilis in Southeast Asia contains a suspected hardware implant. The implant was discovered by an Indonesian customer who opened the device and found an additional circuit board placed between the wallet’s main board and its screen. The extra board reportedly includes a cellular module and an antenna.
Based on unconfirmed customer-supplied information cited by Trezor, the implant appears capable of reading information displayed on the screen — including the wallet recovery phrase — and transmitting that data over a mobile network when the device is plugged in. Trezor has not yet received the device for examination and therefore has not confirmed whether the component is malicious.
How the incident came to light and Trezor’s immediate actions
The company says concerns began after the Indonesian buyer’s report about a Safe 5 purchased from CryptoBilis via Tokopedia in August 2026. Trezor says it immediately stopped device sales through CryptoBilis on October 9, 2026 — a pause it enacted in response to a related supply-chain incident affecting another vendor, Ledger, and before Trezor had any indication its devices were impacted.
Trezor is asking potentially affected users to move their private keys and digital assets to known safe wallets and to avoid setting up or using any device bought via CryptoBilis from March 2026 onward. The company is awaiting receipt of the device, which is currently being shipped to it, and pledged to provide updates after examination. Trezor said it is not aware of any funds having been stolen as a result of a supply-chain attack tied to this report.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleLinks to Ledger losses and the CryptoBilis reseller
CryptoBilis is the same retailer implicated in a Ledger implant incident that unfolded earlier in October 2026, and Trezor says the implants on the two devices “appear to be similar in form and function.” Ledger later confirmed that compromise and asked resellers and distributors in Southeast Asia and Hong Kong to halt all sales until investigations confirm device safety.
Multiple reports of losses by Ledger users have emerged since earlier this month; a recent Singapore police announcement added $3,500,000 to the tally of reported losses. Trezor has said it will restructure and tighten its reseller network globally to maintain higher levels of security.
Guidance Trezor is giving affected users
- Trezor recommends not setting up or using any device bought via CryptoBilis from March 2026 onward.
- Users who have already set up devices purchased from CryptoBilis are advised to move their funds to a newly created wallet with a new recovery phrase.
- Buyers with proof of purchase may contact Trezor for a replacement device or a voucher for a new device.
- Trezor emphasized that weighing devices is not a reliable way to determine whether they have been tampered with.
What this means for end users, resellers, and law enforcement
- End users: Owners of Safe 5 devices bought from CryptoBilis should assume potential compromise for purchases from March 2026 onward, follow Trezor’s advice to create new wallets and recovery phrases, and retain proof of purchase if they seek a replacement or voucher.
- Resellers and distributors: Companies selling hardware wallets in Southeast Asia and Hong Kong face immediate pressure to audit supply chains; Ledger’s halt request for resellers in those markets and Trezor’s decision to stop sales through CryptoBilis signal a need for tighter reseller vetting and controls.
- Law enforcement and investigators: The Singapore police notification of an added $3,500,000 in Ledger user losses underscores the financial scale attracting investigative attention and the cross-border nature of these reports, which may shape inquiries and coordination with sellers and platforms such as Tokopedia.
Trezor’s public steps — halting sales from a single reseller, advising users to move funds, and promising a technical analysis once the device arrives — leave a clear, immediate task: confirm whether the board is malicious, determine how it entered the supply chain, and establish whether customer funds have been exposed. The company says it will provide updates after it receives and examines the device.
For context on defensive posture more broadly, the source also cites an industry study: “Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.” The Blue Report 2026 referenced in that note measures defenses technique by technique across 338 million simulations run in customer production environments.
