Trezor: CryptoBilis sale of Safe 5 may have involved a hardware implant; users urged to move funds
Trezor posted on X on October 30, 2026, saying that through responsible disclosure it learned that a single hardware implant exists in a Trezor Safe 5 device purchased from the reseller CryptoBilis in August 2026. No CryptoBilis buyers have reported any loss of funds to Trezor so far.
Trezor said it has not yet received the device to confirm the report, but based on the customer’s description it considers it credible and is releasing the information in advance so customers who bought Trezor from CryptoBilis can take precautions. For devices purchased from CryptoBilis starting in March 2026, users who have already used them should move their funds to a newly created wallet and new seed as soon as possible, and must not reuse the old seed in any wallet; devices that have not been set up should not be set up, and existing wallet backups must not be entered. Trezor said it removed CryptoBilis from its reseller list on October 9, 2026, and since then it has checked four Trezor devices bought through that channel, finding no signs of tampering in any of them. Affected users may keep the device and contact support to obtain a new hardware wallet. Trezor is investigating with SEAL_911 and will provide updates.
Original source:
Title: CryptoBilis update Publisher: Trezor (@Trezor) Publication date: 2026-10-30 URL: https://x.com/Trezor/status/2116062963752747040 Source type: official company post Verification status: this reading retrieved the full post, verification date 2026-10-30 Supporting content: report of a single Safe 5 hardware implant, no report of funds lost, migration advice for buyers from March 2026 onward, not yet received the device but considered credible, removal from reseller list on October 9, four devices checked with no tampering found, cooperation with SEAL_911, contact support to obtain a new device
ABAB AI Insight
Trezor’s disclosure this time came after Ledger had already confirmed that devices sold by CryptoBilis contained a screen-reading hardware implant. Compared with the earlier wording of “no reports, no signs,” this time Trezor treated the report of a single Safe 5 implant as credible and notified users in advance, showing a preventive escalation in response to physical tampering risk in the reseller channel.
Trezor clearly distinguished between “has not yet received the device for confirmation” and “considers it credible based on the description,” and limited its recommended actions to devices purchased from CryptoBilis starting in March 2026. The requirement for already used devices to migrate to a new seed and prohibit reuse of the old seed, and for unset devices not to be set up and not to enter existing backups, are typical isolation measures under a supply-chain attack.
Trezor had already removed CryptoBilis on October 9 and checked four devices without finding tampering. This report brings the Safe 5 into focus, but emphasizes that there have been no reports of funds lost, and that it is cooperating with SEAL_911 in the investigation. Hardware wallet security depends on physical integrity, and an implant at the reseller stage makes official-channel verification and direct purchase key paths for reducing risk.
ABAB News · Law of cognition
A report of a single-device implant was made public in advance, showing that preventive notice takes priority over final confirmation in a supply-chain incident.
Devices already in use must be migrated to a new seed and reuse is prohibited, turning physical tampering risk into a seed-isolation requirement.
Even after the reseller channel was removed, reports still emerged, indicating that physical integrity checks for hardware wallets need to cover the sales channel.