Trezor CryptoBilis buyers from March 2026 told to get a new seed

If you bought a Trezor from CryptoBilis since March 2026 and keep funds on it, Trezor wants you to start over with a new seed. Trezor's notice of Oct. 30, 2026, calls for moving the funds to a newly created wallet as soon as possible. Restoring your old backup on another device leaves the issue in place. The advice is a precaution after a reported hardware implant in a single Trezor Safe 5.

Every model bought since March needs a new seed

Trezor's notice covers every Trezor model bought from CryptoBilis from March 2026 onward. That includes any store selling devices CryptoBilis supplied, such as its store on Tokopedia. If you are unsure where your device came from, check the seller name on your receipt or contact Trezor Support.

The new seed is the step that counts. A seed is the recovery phrase that restores a wallet on any device, like a master key that opens the same safe anywhere. According to the report, which Trezor says it has not verified, the implant reads what the screen shows, including that backup, and sends it over a mobile network whenever the device is plugged in.

The notice sets out these steps for CryptoBilis buyers:

• Create a new wallet with a new seed and move your funds to it as soon as possible.
• Using the old backup on another device does not solve the issue.
• Leave an unset CryptoBilis device unset, and keep every existing wallet backup off it.
• Park funds temporarily in a software wallet or an exchange you know if no other secure hardware wallet is at hand. Check the full receiving address before you send.
• Keep the CryptoBilis device and contact Support for a new Trezor shipped directly or a voucher covering the cost of one.
• Skip the scale. Weight can neither confirm nor rule out tampering, and owners have no dependable way to inspect a device themselves.
• Expect phishing about the incident through fake emails, physical letters and phone calls. Keep your recovery phrase to yourself; Trezor Support will never ask for it.

A single Safe 5 report set off the warning

Trezor's security team received the report on Oct. 28, 2026, from a Trezor customer in Indonesia. It came through responsible disclosure, a private report of a security problem to the maker before it goes public. The device is a single Safe 5 bought from CryptoBilis in August 2026 via Tokopedia.

A hardware implant is an extra part fitted inside a device after it left the factory, like a skimmer hidden in an ATM card slot. The reported implant is an extra circuit board with a cellular module and an antenna. It sits between the Safe 5's main board and its screen.

Trezor treats the report as credible after receiving photos and interviewing the reporter by video call. Its lab will examine the device once it arrives. That exam would show whether the implant exists and works as the report describes.

Trezor chief commercial officer Danny Sanders explained the early warning to Cointelegraph. The company would rather warn people now than wait for lab confirmation and find that someone lost funds in the meantime.

The reporter had already moved the funds off the device before finding the implant. As of Oct. 30, no CryptoBilis buyer had reported a loss of funds to Trezor. Trezor will update its notice if that changes.

A Trezor spokesperson gave Cointelegraph three more details. The company has yet to establish where the suspected tampering occurred. Seals and packaging are not sufficient on their own, and Trezor is reviewing its hardware protections. Sales through CryptoBilis were very small, though Trezor declined to give figures.

Trezor cut off CryptoBilis on Oct. 9

CryptoBilis was an official Trezor reseller in Southeast Asia until October 2026. Trezor says it removed CryptoBilis on Oct. 9, 2026, the day Ledger began investigating fund losses among customers who had bought from CryptoBilis. Trezor says it has since limited its authorized sellers going forward to secure its supply chain.

That removal came 19 days before the Safe 5 report reached Trezor on Oct. 28. The reported device was bought in August, while CryptoBilis was still an authorized Trezor seller.

Ledger said in an Oct. 15, 2026, post that a highly organized criminal group put tampered Ledger devices back into distribution through resellers in Southeast Asia. Trezor's notice and Cointelegraph tie those devices to CryptoBilis. The notice adds that the Safe 5 implant appears to operate similarly to those seen in Ledger devices. Trezor will hold off on further comparisons while investigations are ongoing.

The Ledger side of the case is covered in Ledger's CryptoBilis update, Ledger's reset advice for CryptoBilis buyers and whether Ledger's Genuine Check can catch a hardware implant.

Other resellers are the line to watch

If you bought your Trezor elsewhere, watch the reseller scope. As of Oct. 30, Trezor had no reports involving any other reseller and will update customers if that changes. The Trezor hub covers the other models.

For CryptoBilis buyers, the next milestone is Trezor's lab result on the reported Safe 5.