Trezor warns of suspected implant in Safe 5 bought from CryptoBilis

Trezor has urged anyone who bought devices from CryptoBilis since March to move their funds, following a report of a suspected hardware implant in a Safe 5. According to reports from Decrypt, Cointelegraph and The Block on October 30, 2026, the company considers the report credible but has not yet examined the device in question.

What was reported about the Trezor Safe 5?

The report concerns a possible extra component inside a Safe 5 sold by CryptoBilis. The Safe 5 is a hardware wallet, a device used to manage cryptocurrency. In this case the suspicion concerns the device’s hardware itself, not an incident that the available sources describe as an app breach.

The Block reports that Trezor received a credible report of an implant inside the device. Decrypt adds the crucial caveat: the manufacturer has not examined it yet. So what we have is a warning the company is taking seriously, not a completed technical finding.

Which buyers does the warning cover?

Trezor’s warning is aimed at customers who bought devices from CryptoBilis since March. As Cointelegraph reports, the company is asking them to move their funds. That recommendation is attributed to Trezor and is tied to the report of the suspected implant.

We want to highlight the difference between the device that was reported and the audience of the warning. The report concerns a single Safe 5, while the notice to buyers has a broader scope. That does not prove that every device sold by CryptoBilis has been tampered with. Nor does the available information support extending the case to all Trezor wallets.

What do we know and what remains open?

The main gap is that the manufacturer has not examined the device. The information from the three sources does not describe how the possible implant works, how it was found inside the device, or how many other devices might be affected.

There is also no information about any confirmed loss of funds. So the precautionary transfer the company is asking for is one thing, and a claim that theft has already happened is another. We think this distinction needs to stay clear, especially in a story where concern can easily outrun the confirmed facts.

What does it mean for holders in Greece?

For a holder in Greece, the test that follows from the warning is where and when they bought their device, not where they live. This particular notice covers purchases from CryptoBilis since March.

We think Trezor is right not to wait for the final finding before alerting these customers. At the same time, we will not label the suspicion a confirmed breach. The next meaningful piece of information we are waiting for is the examination of the Safe 5 and what it shows about the nature and extent of the problem.