Trezor Safe 5 sold by CryptoBilis had spyware

Trezor says it has seen one of its hardware wallets sold by CryptoBilis, its official Malaysian-based reseller, containing a physical spyware implant. The tampered device was a Safe 5, bought from CryptoBilis in August this year.

Trezor told Protos the implant is an extra circuit board fitted between the main board and the screen, with a cellular module and an antenna. The user report, which Trezor has not yet thoroughly verified, says the implant reads what the screen shows, including the wallet backup, and sends it out over a mobile network whenever the device is plugged in. Trezor says the setup resembles how an earlier spyware device in Ledger wallets worked.

Buyers who purchased a wallet from CryptoBilis since March 2026 were told to move their funds out of the wallet and contact Trezor's team, which will provide a replacement. Trezor says it will replace wallets sourced through CryptoBilis.

Chief Commercial Officer Danny Sanders said the device has not been in Trezor's lab yet, but the company is treating the report as credible and would rather warn people now than wait for confirmation. Trezor also said it has checked four other CryptoBilis-sourced wallets and found no evidence of tampering, and that no funds have been reported as stolen.

Trezor dropped CryptoBilis as an official reseller on October 9, after an $86 million Ledger wallet hack that relied on spyware installed in CryptoBilis-sold wallets. Trezor now says it is reviewing its other Asia-based resellers and may drop more in the future.

After that hack, Ledger cut ties with official resellers across Malaysia, Indonesia, Singapore, Thailand, the Philippines, Vietnam and Hong Kong. At the time of the Ledger hack, Trezor said there was no evidence its own devices had been compromised.