Trezor warns buyers of devices from reseller CryptoBilis after report of a hardware implant
Trezor said on X on 30 October 2026 it was told of a hardware implant in one Trezor Safe 5 bought from reseller CryptoBilis. It has not confirmed the report; it advises buyers since March 2026 to move funds to a new wallet.
- First reported
- Reports
- 1
Source: x.com · published
What happened
Hardware wallet maker Trezor said in a post on its official X account on 30 October 2026 that it had been made aware, through its responsible-disclosure programme, of a single hardware implant in a Trezor Safe 5 device bought from the reseller CryptoBilis in August 2026. No CryptoBilis buyer has reported a loss of funds to Trezor. Trezor says it has not yet received the device to confirm the report but, based on the customer's description, is treating it as credible and sharing it now so buyers can protect their funds as a precaution. Its security team will examine the device when it arrives. This is Trezor's report of an unconfirmed claim, not a finding about CryptoBilis.
How the scam works
A hardware wallet protects crypto by keeping the private keys on a device the owner controls. A tampered device is dangerous because the owner may trust it and put their recovery phrase or funds on it. Trezor says it removed CryptoBilis as a reseller on 9 October 2026 following reports of tampered Ledger devices sold through that reseller. Since then it has inspected the Trezor devices customers bought from CryptoBilis and found no signs of tampering on any of the four devices it has received so far. Trezor does not say how the implant would work.
Trezor's advice is aimed at anyone who bought a Trezor from CryptoBilis from March 2026 onwards. If the device is already in use, move the funds to a newly created wallet with a new seed as soon as possible and never reuse the old seed in any wallet, hardware or software; if no other secure hardware wallet is available, Trezor suggests temporarily moving funds to a software wallet or an exchange you know. If the device is not set up, do not set it up and never enter an existing wallet backup on it. Trezor adds that its support will never ask for your recovery phrase, and that affected customers should keep the device and contact Support for a replacement.
Source
Trezor (@Trezor) post “CryptoBilis update” on X, 30 October 2026.
Red flags
- A hardware wallet bought from a third-party reseller rather than the maker's own store or an authorised retailer.
- A device bought from a reseller that the manufacturer later removed from its list of resellers.
- Any request, by support or anyone else, for your recovery phrase.
- A report of a reseller that sold tampered devices from another brand, which led Trezor to remove it.
- Packaging or security seals that look damaged or altered.
If you were targeted
- 1If you bought a Trezor from CryptoBilis from March 2026 onwards and use it, move your funds to a newly created wallet with a new seed and never reuse the old seed.
- 2If it is not set up, do not set it up and never enter an existing backup on it.
- 3Keep the device and contact Trezor Support to receive a replacement.
- 4Never share your recovery phrase with anyone; Trezor Support will never ask for it.
- 5Buy hardware wallets only from the maker or its authorised resellers.