Hardware Implants found in Trezor safe 5

[Ashawowo(OS)]

Trezor has confirmed hardware implants in one of the hardware wallets sold by the reseller Cryptobilis, there may be more. No records of funds loss so far, but it's best those that purchased the device from March 2026 to move their funds away from it. Scammers might be waiting for the best time to strike

CryptoBilis update

We've been made aware, through responsible disclosure, of a single hardware implant in a Trezor Safe 5 device bought from the reseller CryptoBilis in August 2026.

No CryptoBilis buyer has reported a loss of funds to us.

IMPORTANT: If you bought a Trezor from CryptoBilis from March 2026 onwards, we know this is unsettling. Here’s what to do:

Already using it?

Move your funds to a newly created wallet with a new seed as soon as possible. Do not reuse the old seed in any wallet, hardware or software.  If you don’t have another secure hardware wallet available, we recommend temporarily migrating your funds to a software wallet or an exchange you are familiar with.  

Not set up yet? Don’t set it up, and never enter your existing wallet backup on it.

We haven’t received the device to confirm this report, but based on the customer’s description, we’re treating it as credible and sharing it now so customers who purchased a Trezor via CryptoBilis can secure their funds as a precaution. Our security team will examine the device as soon as it arrives.

https://x.com/Trezor/status/2116062963752747040

[OmegaStarScream]

What's with the date though. The March 2026? Is this supposed to be when CryptoBillis received their latest batch or when the service was sold to someone else? If the latter, then didn't Ledger users report losses even prior to that date? dating back to mid-2025 if I'm not mistaken.

[LuckyCrypto777]

I really hope that this is an isolated incident, because most likely, during the excitement with Ledgers, conscientious Trezor holders should have checked the structure of their hardware wallets.

Mark Karpeles is willing to pay for the delivery of a compromised Trezor to anyone who sends him their Trezor for study into the nature of malicious chips.
https://x.com/MagicalTux/status/2116063448597688782?a=a0vYNv3oX9YDV4WmsBA&s=19

But he warned them two weeks ago...

[Charles-Tim]

The same official reseller that was selling tampered Ledger Nano.

I just hope people that bought any hardware wallet form the reseller move their coins from the addresses of the wallet bought from the reseller.

If you don’t have another secure hardware wallet available, we recommend temporarily migrating your funds to a software wallet or an exchange you are familiar with.

When exchanges are getting hacked.

[Wind_FURY]

Trezor has confirmed hardware implants in one of the hardware wallets sold by the reseller Cryptobilis, there may be more. No records of funds loss so far, but it's best those that purchased the device from March 2026 to move their funds away from it. Scammers might be waiting for the best time to strike

CryptoBilis update

We've been made aware, through responsible disclosure, of a single hardware implant in a Trezor Safe 5 device bought from the reseller CryptoBilis in August 2026.

No CryptoBilis buyer has reported a loss of funds to us.

IMPORTANT: If you bought a Trezor from CryptoBilis from March 2026 onwards, we know this is unsettling. Here’s what to do:

Already using it?

Move your funds to a newly created wallet with a new seed as soon as possible. Do not reuse the old seed in any wallet, hardware or software.  If you don’t have another secure hardware wallet available, we recommend temporarily migrating your funds to a software wallet or an exchange you are familiar with.  

Not set up yet? Don’t set it up, and never enter your existing wallet backup on it.

We haven’t received the device to confirm this report, but based on the customer’s description, we’re treating it as credible and sharing it now so customers who purchased a Trezor via CryptoBilis can secure their funds as a precaution. Our security team will examine the device as soon as it arrives.

https://x.com/Trezor/status/2116062963752747040

Change the title. There was ONE implant that's currently being reported, and whether or not there's more has NOT been confirmed yet.

BUT it's still VERY concerning. Let's wait for any updates from Trezor in the coming days/weeks after the device is delivered and checked in their Lab.

[Ruttoshi]

I don't get it, why is this from only CryptoBilis and not from a different reseller. It shows that an insider CryptoBilis is either tampering with the wallet or someone from outside is taking advantage of the company to implant chips in the hardware wallets in their possession. I hope no one using Trezor Safe 5 will be affected because the losses are too much this year.

 I think other hardware wallets that company that CryptoBilis is dealing should check all their hardware wallet in CryptoBilis company. Who knows if there will be an implant on a different brand of hardware wallet in CryptoBilis.

[goldkingcoiner]

I don't get it, why is this from only CryptoBilis and not from a different reseller. It shows that an insider CryptoBilis is either tampering with the wallet or someone from outside is taking advantage of the company to implant chips in the hardware wallets in their possession. I hope no one using Trezor Safe 5 will be affected because the losses are too much this year.

 I think other hardware wallets that company that CryptoBilis is dealing should check all their hardware wallet in CryptoBilis company. Who knows if there will be an implant on a different brand of hardware wallet in CryptoBilis.

This is obviously not a coincidence. I think that Cryptobilis knows exactly what they are doing. What are the chances that one reseller suddenly has two products tampered with? Especially after the first one, there should have been a quality check. So there is not much doubt in my mind this is happening on purpose and Cryptobilis is knowingly involved in it.

There is something funky going on....

[ABCbits]

Any customer who purchased from CryptoBilis from March 2026 onwards is eligible to receive a new Trezor device, which we will ship directly, or provide a voucher to cover the cost of a new device. Please keep your CryptoBilis device and contact Support to arrange this.

If it's true, then Trezor is being very generous. Last time i checked, Ledger never offered this kind of compensation from anyone who buy their device from CryptoBills.

I don't get it, why is this from only CryptoBilis and not from a different reseller. It shows that an insider CryptoBilis is either tampering with the wallet or someone from outside is taking advantage of the company to implant chips in the hardware wallets in their possession. I hope no one using Trezor Safe 5 will be affected because the losses are too much this year.

Whether they do it intentionally or don't have security good enough to prevent tampering, IMO their company should be closed.

[Zaguru12]

What's with the date though. The March 2026? Is this supposed to be when CryptoBillis received their latest batch or when the service was sold to someone else? If the latter, then didn't Ledger users report losses even prior to that date? dating back to mid-2025 if I'm not mistaken.

Yes the March 2026 cut off was actually linked to the period which the CryptoBillis company was sold off [1]and it was what the former CEO pointed out and ledger plus other hardware wallets pointed out that it is within this period that the new owners who was reported to be a Chinese had access to the supply chain. So they believe that someone buying from them since March might have been victims.

I wanted to ask why the hardware Wallet companies didn’t stop distribution when they know of the ownership changes but it was reported that it wasn’t public announced by the company.

Still the fault is with the company that do not have tamper proof for their device.

[1] https://www.kucoin.com/news/flash/cryptobilis-ownership-changed-in-march-linked-to-ledger-wallet-security-incident

[satscraper]

What's with the date though. The March 2026? Is this supposed to be when CryptoBillis received their latest batch or when the service was sold to someone else? If the latter, then didn't Ledger users report losses even prior to that date? dating back to mid-2025 if I'm not mistaken.

Regarding the date I wonder why buyer didn’t send them his wallet for analysis yet. Now is almost November. Wallet was bought in August. At least they could ask him  to open Trezor's case, take the picture of inside, and send them the relevant images. Trezor’s techs could guide him online using live video communication .

Would be interesting to ave a look on case stuffing.

[Dunamisx]

It is now that Trezor also realized their retailers could have compromised things for them after the Ledger incident; remember, some members already suggested there is still more to be revealed about the order hardware wallet that may be in question. This is getting too much these days, with the way hacking is happening.

[KiaKia]

This took a long time already, why now Trezor? Cryptobilis is nothing new, once the Ledger attack happened every companies that have used Cryptobilis should have known what theyve signed up for.

I'm hoping that the damages aren't already done, so far I checked through reedits and I don't see any news regarding Trezor getting drained,aybe it's harder to tampered with Trezor than Ledger?

It's better to be safer than sorry though, I will rather chose to use Electrum wallet right now over Trezor if I am one of those people using Trezor hardware wallet.

[dkbit98]

Sadly this was expected to happen, and any hardware wallets coming from Asian region should be considered a red flag now.
Trezor released more information about this on their website, and they will physically examine affected device.
Someone should arrest people working in Cryptobilis and take them to court for tampering with devices.
https://trezor.io/blog/news/implant-reported-in-a-trezor-sold-by-cryptobilis

[promise444c5]

Well, we will love to see the the pictures before they open it up for investigation... I guess it has to be obvious that someone opened the hardware wallet already.

They said they have the image of how the casing looks like , not sure why they can’t just put it on the blog already.

I think other hardware wallets that company that CryptoBilis is dealing should check all their hardware wallet in CryptoBilis company. Who knows if there will be an implant on a different brand of hardware wallet in CryptoBilis.

What every normal human being should  have done is move their funds out of their hardware wallets so far there’s any reported case from the official reseller they bought their hardware wallets . I hate assumptions, I will rather be wrong and safe than assume “everything is fine.. it’s not gonna happen”.

[Filicius]

The same official reseller that was selling tampered Ledger Nano.

First, I read what happened and I wasn't surprised, given the streak of attacks so diverse and on such heterogeneous companies, from exchanges to predictive markets to manufacturers of physical devices. It is the third attack that I would be aware of today.

However, when reading that this is the same Ledger reseller, cryptobilis, it had not occurred to anyone before that this could have happened? not to me, because I did not imagine that the same reseller worked for both firms, Ledger and Trezor, but for anyone who knew it seems the next logical step.

[salad daging]

I don't get it, why is this from only CryptoBilis and not from a different reseller. It shows that an insider CryptoBilis is either tampering with the wallet or someone from outside is taking advantage of the company to implant chips in the hardware wallets in their possession. I hope no one using Trezor Safe 5 will be affected because the losses are too much this year.

 I think other hardware wallets that company that CryptoBilis is dealing should check all their hardware wallet in CryptoBilis company. Who knows if there will be an implant on a different brand of hardware wallet in CryptoBilis.

Only CryptoBilis resellers are naughty so they have from the beginning had the intention to implant eye implants inside the device, this being another big disadvantage for other honest resellers.
If this is the case, there is a possibility that resellers have decreased purchasing power, the problem is that many people no longer believe in buying hardware from third parties, especially now that Trezor has been associated.

[SFR10]

Someone should arrest people working in Cryptobilis and take them to court for tampering with devices.

I'm quite surprised nothing has happened on that front... Last time I checked, a Ledger representative indirectly said they might consider it depending on the result of their investigation, but I prefer not to keep my hopes up ^{[let's see if Trezor takes any legal action after the confirmation (assuming that'll be the case given that they've already seen the pictures and there was a live video interview)]}.

[julerz12]

Not surprising... they have access to a lot of hardware wallets; why stop at one egg when you can crack a whole tray. 
At this point, anybody who purchased whatever hardware wallet from that reseller should just stop using it and move their funds immediately. Better to be safe than sorry.

CryptoBilis

https://www.cryptobilis.com/

And...that reseller also sells lots of other hardware wallets.   SecuX, Trezor, and SafePal.
If they really did tamper with the devices they've been selling, more hardware wallets are probably gonna get drained in the next couple of hours.

[KiaKia]

It doesn't ends here, Ledger supply chain in Singapore is also compromised, I got this news on X from CZ himself, and there are many crypto users in Singapore, I am tired of asking what's happening.

Malicious hardware implants are now the hot topics with hardware wallets this days, aren't these people supposed to be arrested and sentenced to prison straight?

They took their time to make implants that will work just like the OEM chips and swap them out one after the other, this should be treason and it deserves a lot of punishment.

No mercy should be shown to such human beings

[Pmalek]

Sadly it was expected that these implants would be found in other hardware wallets besides Ledger, especially those connected to CryptoBilis that sold many different brands. I seriously doubt that someone only modified one Trezor and stopped there. I am afraid this is just the beginning of many more to come.

I don't get it, why is this from only CryptoBilis and not from a different reseller. It shows that an insider CryptoBilis is either tampering with the wallet or someone from outside is taking advantage of the company to implant chips in the hardware wallets in their possession. I hope no one using Trezor Safe 5 will be affected because the losses are too much this year.

It's not only CryptoBilis. If we look back at the Ledger implants, modified devices were sold in multiple shops. CryptoBilis is one. Lazada in Thailand was another, even earlier one. After that there was a case of a Ledger purchased in Singapore's airport and multiple cases in Europe.

If it's true, then Trezor is being very generous. Last time i checked, Ledger never offered this kind of compensation from anyone who buy their device from CryptoBills.

We don't know that for sure. Maybe those who contact them get free replacements. I remember years ago that people reported that Ledger gave free replacement devices even to customers with expired warranties if their hardware wallets broke.