Trezor Urges CryptoBilis Buyers to Move Funds After Suspected Safe 5 Implant

Trezor has urged customers who bought hardware wallets through former authorized reseller CryptoBilis since March to transfer their funds, after a report of a suspected implant in a Safe 5 device. The company said on Friday that a customer in Indonesia reported finding an unauthorized circuit board in a Safe 5 purchased on Tokopedia in August. The customer report said the suspected implant could capture information from the screen, including wallet recovery phrases, and send it over a cellular network. Trezor said it had not examined the device and had received no reports of related losses. Chief Commercial Officer Danny Sanders said the company considered the report credible even though the device had not yet reached a laboratory. He said Trezor chose to warn customers before confirmation rather than risk customers losing funds while waiting. A Trezor spokesperson described sales through CryptoBilis as very small and declined to disclose figures. The spokesperson said Trezor had not determined where the suspected tampering occurred and was reviewing its hardware protections. The spokesperson acknowledged that existing safeguards, including packaging and seals, could not provide sufficient protection on their own. Reports of cryptocurrency losses involving Ledger wallets bought through CryptoBilis emerged on October 9. Ledger confirmed that one affected device contained an unauthorized hardware implant. Security researcher Joe Grand said previously that he had warned Trezor in August about tampered Trezor One and Model T wallets. Those wallets had been bought from unauthorized sellers through TikTok and Facebook. Trezor said an earlier statement that it had no evidence of compromised devices concerned only new wallets bought through authorized resellers. At the time, Trezor said its setup checks were designed to detect counterfeit devices and altered firmware. The implant found in a Ledger device sold through CryptoBilis captured screen information without modifying the firmware. An attacker with a stolen recovery phrase can restore a wallet on another device and transfer the funds. Trezor announced on October 13 that it planned to shrink its reseller network.