The discovery of a malicious module inside a Trezor Safe 5 prompted an official warning from the hardware wallet manufacturer on October 30, 2026. The advisory applies to all customers who purchased hardware wallets from former reseller CryptoBilis. The alert originated from a security disclosure report submitted on October 28, 2026, by a buyer in Indonesia who had ordered a Trezor Safe 5 unit through Tokopedia in August 2026.
The buyer’s report was promptly verified by Trezor via photo documentation and a video call interview. Deeming the report credible, the company quickly arranged for the unit to be shipped from Indonesia to its laboratory for an in-depth physical examination.
What sets this finding apart from ordinary security rumors is the presence of tangible physical evidence discovered directly beneath the device’s casing.
How the Rogue Cellular Module Works
The Indonesian buyer disassembled his hardware unit after noticing irregularities beneath the casing. Inside, he discovered an extra circuit board sandwiched between the motherboard and the display component. The foreign component was found to house an antenna and a hidden cellular module.
The unauthorized circuitry is suspected of being capable of intercepting sensitive user data, including the recovery seed phrase during initial device setup. The intercepted data was then transmitted over a cellular network whenever the wallet was connected to a power source.
The buyer who uncovered the physical modification had already moved all his crypto holdings off the device, avoiding any loss of funds.
Echoes of the Ledger Case and Partnership Revocations
CryptoBilis was previously listed as an authorized reseller for both Trezor and Ledger in Southeast Asia. However, that partnership has since ended. Trezor revoked CryptoBilis’s reseller authorization on October 9, 2026, following a similar incident that previously struck Ledger devices.
In the Ledger case linked to CryptoBilis, Arkham Intelligence traced the theft of $95.35 million across 1,486 addresses between October 7 and 9, 2026. Around the same time, the Singapore Police Force recorded losses of S$3.5 million in two cases involving modified hardware.
Precautionary Steps for CryptoBilis Customers
Although the Ledger incident resulted in heavy losses, Trezor emphasized one crucial point: as of the October 30, 2026 announcement, there have been no reports of lost funds among Trezor customers who purchased through CryptoBilis.
Despite the absence of reported losses, Trezor advised anyone who purchased any Trezor model from CryptoBilis since March 2026 to immediately transfer all their crypto assets to a secure wallet address as a precaution.
For owners of devices purchased through that distribution channel, moving balances before Trezor completes its laboratory analysis is the most sensible measure to ensure their crypto assets remain protected.
Reported via crypto.news.
Read also: Zano Rolls Back Blockchain to Block 3,833,000 Following Gateway Exploit - A Rare Emergency Action
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
