Trezor Safe 5 from CryptoBilis Carries Cellular Exfiltration Board

The customer reported the implant to Trezor on October 28 after noticing weight anomaly. Photos show a cellular module and antenna positioned to OCR the display during setup. Trezor has not yet received the physical device for lab analysis but dropped CryptoBilis as authorized reseller on October 9 following parallel Ledger implant reports. All devices supplied by CryptoBilis since March 2026 are now treated as compromised regardless of model.

Evidence consists of customer-provided images, video interview, and receipt trail. No independent verification exists yet; Trezor states small weight variances alone are inconclusive. The implant design mirrors the Ledger modification described in Singapore Police Force advisory of October 28 that cited two confirmed cases since September. Both vendors note the hardware captures the seed during initial setup or display, bypassing software protections.

Supply chain insertion at regional resellers creates an attribution gap between technical evidence of physical tampering and any named actor. Official statements from Trezor and Ledger avoid assigning responsibility while Singapore police continue active investigation. Pattern matches prior documented cases where authorized channel compromise allowed seed capture without firmware changes.

Trezor instructs immediate fund migration to fresh wallets and new seeds for affected buyers. Users must retain the device for potential forensic return rather than attempting self-inspection. Next step is physical lab confirmation expected within two weeks; until then every CryptoBilis-sourced unit remains suspect.