A suspected hardware implant found in a Safe 5 wallet bought from earlier reseller CryptoBilis prompted Trezor to alert customers, adding to growing concerns about compromised cryptocurrency devices. The warning comes as Singapore authorities investigate two cases of tampered Ledger wallets that allegedly resulted in S$3.5 million in losses.

While a separate $13 million Bitcoin theft case emphasises the financial harm caused by stolen wallet access, both events have drawn attention to dangerous components being placed into hardware wallets before they reach clients.

Trezor Identifies Hidden Cellular Implant in Safe 5 Wallet

After receiving a responsible disclosure report regarding a hardware implant into a Safe 5 device that was bought from CryptoBilis in August 2026, Trezor issued an urgent security alert. The report relates to a single gadget that has a hidden cellular module that, when powered on, may read and transmit data displayed on its screen, according to the company's October 30 announcement.

The reported gadget has not yet been physically inspected by Trezor. However, before finishing its inquiry, the company believes the customer's description is reliable enough to issue a public warning. When the device is delivered, its security team intends to inspect the hardware.

Everyone who bought a Trezor wallet through CryptoBilis starting in March 2026 has been urged by the company to take immediate safety measures. Consumers who have already set up their devices should use a brand-new recovery seed to move their cryptocurrency to a newly generated wallet. They are prohibited from using their current seed in a different software or hardware wallet.

Customers should not utilise their gadgets if they haven't configured them. Entering an existing wallet backup into a potentially compromised device has been specifically cautioned against by Trezor.

Additionally, the company has provided free replacement Trezor hardware wallets to impacted clients. Customers are asked to keep their CryptoBilis devices and get in touch with the company's official support staff to set up replacements.

CryptoBilis update

We've been made aware, through responsible disclosure, of a single hardware implant in a Trezor Safe 5 device bought from the reseller CryptoBilis in August 2026.

No CryptoBilis buyer has reported a loss of funds to us.

IMPORTANT: If you bought a Trezor from CryptoBilis from March 2026 onwards, we know this is unsettling. Here’s what to do:

Already using it?

Move your funds to a newly created wallet with a new seed as soon as possible. Do not reuse the old seed in any wallet, hardware or software. If you don’t have another secure hardware wallet available, we recommend temporarily migrating your funds to a software wallet or an exchange you are familiar with.

Not set up yet? Don’t set it up, and never enter your existing wallet backup on it.

We haven’t received the device to confirm this report, but based on the customer’s description, we’re treating it as credible and sharing it now so customers who purchased a Trezor via CryptoBilis can secure their funds as a precaution. Our security team will examine the device as soon as it arrives.

On October 9, 2026, we removed CryptoBilis as a reseller following reports of tampered Ledger devices sold through it. Since then, we have been inspecting Trezor devices that customers bought from CryptoBilis and have found no signs of tampering on any of the four devices we’ve received so far.

NEVER share your wallet backup (recovery phrase) with anyone. Trezor Support will never ask for it.
If you are affected by this incident, please keep your CryptoBilis device and contact Support to receive a new Trezor hardware wallet: https://t.co/5EasOVDDQh

We're investigating and will post updates here as soon as we know more. Thank you to the customer who reported this through our responsible disclosure program, and to @SEAL_911 for working alongside our teams on the response. Reports and engagement like this help us protect everyone else.

For more information, visit our blog: https://t.co/2LmFV8L2oe

— Trezor (@Trezor) October 30, 2026

CryptoBilis Investigation Extends Beyond the Trezor Incident

Before the most recent Trezor release, CryptoBilis was already under investigation. Following reports of tailored Ledger devices being shipped through the same company, Trezor suspended the reseller from its authorised network on October 9, 2026.

Since then, Trezor has been analysing gadgets bought from CryptoBilis to see if any of its own goods were impacted. The corporation claims that there were no indications of tampering on four devices that were received for inspection. As a result, the recently revealed Safe 5 case is a distinct discovery that has spurred additional research.

Significant alleged cryptocurrency losses are another aspect of the broader CryptoBilis debate. More than 1,400 bitcoin addresses have reportedly lost almost $95 million due to a connected scam. Since Trezor has not linked such losses to the Safe 5 incident, these numbers should be separated from the company's single documented hardware implant.

However, the two incidents concern how infected devices could get into the retail distribution process and involve the same reseller. While Trezor's security team investigates what transpired with the suspected Safe 5 unit, the warning is still cautious.

Singapore Police Confirm S$3.5M Losses From Tampered Ledger Wallets

Concerns over CryptoBilis have also spread to Singapore, where on October 28, 2026, the Singapore Police Force issued a public advisory following reports of at least two occurrences using compromised Ledger hardware wallets.

The police claim that they have registered incidents since September 10, with total losses of about S$3.5 million. According to preliminary investigations, Ledger devices bought from specific Singaporean retail stores included malicious hardware components that may record users' private keys or recovery phrases.

Attackers can access the related cryptocurrency wallets and transfer money without the owners' knowledge or consent once they have these credentials.

The retailers in question have not been recognised by the police. They have acknowledged that they are in touch with Ledger, which is looking into the cases that are impacted. Research is still being done.

Because the incidents in Singapore involve devices bought through local retail stores rather than just the previously revealed CryptoBilis distribution channel, they are very significant. Nevertheless, there is no proof in the police advice that these cases are directly related to CryptoBilis.

Cryptocurrency owners have been warned by authorities to cease using devices that may have been tampered with, as well as to refrain from entering recovery phrases or making more transactions using them. If someone thinks their wallet credentials have been compromised, they should think about moving any remaining money to a reliable device using a fresh recovery phrase.

The police have also warned against sharing recovery phrases or private keys with anyone, including people claiming to represent wallet manufacturers, cryptocurrency exchanges or law enforcement agencies.

Trenton Johnston's $13M Bitcoin Fraud Adds to Security Concerns

Another method by which criminals obtain access to digital assets is demonstrated by a different bitcoin theft case involving 19-year-old Canadian Trenton Johnston. After posing as customer service agents to steal cryptocurrencies from victims, Johnston was sentenced to 25 months in prison.

He allegedly pretended to be Google and Trezor support staff in March 2026 to trick a victim in California into believing that their accounts had been compromised. He took control of the victim's cryptocurrency holdings and stole 185 Bitcoin, worth around $13 million, by getting the victim's access codes.

According to reports, Johnston revealed details about his techniques on Discord and used Signal to discuss the operation with colleagues. A lavish lifestyle that comprised a Lamborghini, two BMWs, a Rolls-Royce, jewellery, and a private jet was also financed by the stolen funds.

Eleven days after the incident, he was arrested by the authorities in Miami. Later, he entered a guilty plea to money laundering conspiracy and was given a 25-month term. The case information provided indicates that around $3.8 million in bitcoin was returned.

The hardware implant investigations are unrelated to this case. Johnston's operation depended on impersonation and getting access information directly from victims, in contrast to the harmful components found in Ledger and Trezor devices.

If you find any issues in this article or notice missing information, please feel free to reach out at team@etherworld.co for clarifications or updates.

To promote your Web3 articles, events, and projects, you may reach out anytime via EtherWorld PR for submissions and collaboration.

Related Articles

1. Ledger Wallet Spy Implant Triggers Karpelès Feud
2. Unagi Assets for Sale After Court Ordered Liquidation
3. Jio’s $106B IPO Hits Bitget With 20x Pre-IPO Perps
4. South Korea Blocks 27 Unregistered Crypto Exchanges
5. 95% of India’s Crypto Offshore, ₹57,147 Crore Lost?

To follow blockchain news, track Ethereum protocol progress, and read our latest stories, subscribe to our weekly today.

Join the EtherWorld & Avarch Internship Program and build your career in blockchain, content, social media, video, podcast editing, or operations. Send your resume and brief introduction to contact@etherworld.co.