Hardware wallet maker Trezor has warned about a suspected malicious implant found in a Trezor Safe 5 device sold by Southeast Asian reseller CryptoBilis.
The company received a report from an Indonesian customer who purchased the device through Tokopedia in August 2026. After opening it, the customer discovered an extra circuit board installed between the wallet's main board and screen. The board reportedly contained a cellular module and antenna.
According to information provided by the customer, the implant may be capable of capturing sensitive information displayed on the screen, including wallet recovery phrases, and sending it to attackers over a mobile network. However, Trezor has yet to receive the device and cannot confirm the findings.
CryptoBilis was also linked to a recent hardware wallet implant discovered in Ledger devices. Ledger has since confirmed the compromise and asked resellers across Southeast Asia and Hong Kong to stop sales while investigations continue.
Trezor had already suspended sales through CryptoBilis on October 9, 2026, following the Ledger incident. The company says it has no reports of stolen funds linked to the suspected attack so far.
For now, Trezor advises customers not to set up or use devices purchased through CryptoBilis from March 2026 onward. Users who may be affected should move their private keys and cryptocurrency to a trusted, secure wallet.
Meanwhile, the US Federal Bureau of Investigation (FBI) has confirmed that a North Korea-linked threat actor tracked as TraderTraitor and Lazarus Group is responsible for a $6 billion Binance crypto theft.