Trezor warns of suspected hardware implant in CryptoBilis wallet

Trezor has warned customers who purchased hardware wallets from former reseller CryptoBilis to move their funds after receiving a report of a suspected malicious implant inside a Trezor Safe 5 device.

Summary

• Trezor has warned customers who purchased hardware wallets from CryptoBilis since March 2026 to move their funds after receiving a report of a suspected implant in a Safe 5 device.
• The suspected implant reportedly contains an additional circuit board and cellular module capable of capturing recovery phrases displayed on the wallet and transmitting them over a mobile network.
• Trezor has not yet physically examined the reported device, but said the information provided by the customer was credible enough to issue a warning. No customer losses have been reported to the company.
• CryptoBilis was removed as an authorized Trezor reseller on October 9 after Ledger confirmed that some hardware wallets sold through the same reseller had been physically tampered with.
• Trezor has advised affected customers to create new wallets with new recovery phrases and is offering replacement devices or vouchers to eligible buyers.

According to an October 30 announcement, the company received a security disclosure on October 28 concerning a wallet purchased through CryptoBilis on Tokopedia in August 2026.

The device was bought by a customer in Indonesia, who reported finding an additional circuit board inside the wallet that could potentially expose sensitive information, including the recovery phrase used to access cryptocurrency holdings.

Trezor said it has reviewed photographs and interviewed the customer through a video call, but has not yet physically examined the device. The company considers the report credible and has advised customers who purchased any Trezor model from CryptoBilis since March 2026 to take precautions.

No customers who bought Trezor devices through the reseller have reported losing funds, according to the company.

Trezor Safe 5 implant could transmit wallet recovery phrases

The suspected implant reportedly consists of an extra circuit board positioned between the wallet’s main board and its screen. It contains a cellular module and an antenna that could allow information displayed on the device to be transmitted through a mobile network.

Based on the customer’s description, the additional hardware appears capable of reading the screen, including the recovery phrase generated during wallet setup, and transmitting that information whenever the device is connected to power.

Anyone who obtains a wallet’s recovery phrase could potentially restore it on another device and transfer its funds without needing the original hardware.

The customer who discovered the suspected implant had already transferred his cryptocurrency out of the device before identifying the additional hardware.

Trezor said its security team is arranging to receive the wallet for laboratory examination. Investigators have not identified who installed the suspected implant or established whether the same attackers were responsible for the earlier Ledger incident.

CryptoBilis previously linked to tampered Ledger wallets

The warning follows an investigation involving Ledger devices sold through CryptoBilis, which previously operated as an authorized reseller for both hardware wallet manufacturers in Southeast Asia.

On October 9, Ledger began investigating reports of cryptocurrency losses among customers who had purchased its wallets through the reseller.

As crypto.news previously reported, Ledger subsequently confirmed that an unauthorized component inside an affected device could capture recovery phrases displayed during setup and transmit them through an LTE cellular connection.

The hidden hardware implant operated separately from the device’s security chip, leaving its normal operating system and transaction signing functions unchanged.

Trezor responded to the initial reports by removing CryptoBilis from its authorized reseller network on October 9 and asking customers to submit their devices for inspection.

By October 19, the company had received four wallets purchased through CryptoBilis, including two Trezor Safe 5 devices, a Safe 7 and a Safe 3. None showed signs of physical tampering during inspection.

The suspected implant disclosed on October 28 concerns a separate Safe 5 device that had not been included in those examinations.

The investigation into Ledger devices has continued. On October 29, blockchain analytics firm Arkham Intelligence traced $95.35 million in suspected thefts involving 1,486 addresses between October 7 and 9.

Arkham reported that approximately $10 million in USDT had been frozen, while the attacker continued moving stolen cryptocurrency across multiple blockchain networks.

Separately, Singapore police reported S$3.5 million in cryptocurrency losses across two cases involving tampered Ledger devices purchased from local retailers.

Trezor has since restricted its authorized reseller network and is working with Ledger and other parties investigating the reported attacks.

Trezor advises CryptoBilis customers to create new wallets

Customers who purchased Trezor devices from CryptoBilis from March 2026 onward have been advised to transfer their cryptocurrency to a newly created wallet with a completely new recovery phrase.

The company warned that importing an existing recovery phrase into another hardware or software wallet would not remove the risk if that phrase had already been exposed.

Users without another secure hardware wallet can temporarily transfer their funds to a familiar software wallet or cryptocurrency exchange. Trezor advised customers to carefully check receiving addresses before making transfers.

Anyone who purchased a device but has not yet configured it should avoid setting it up or entering an existing recovery phrase.

The warning covers every Trezor model supplied by CryptoBilis, including devices sold through Tokopedia and other stores that obtained their inventory from the reseller.

Trezor said customers should not attempt to identify tampering by opening or weighing their wallets. Although the customer who reported the implant noticed a weight difference, the company said weight measurements cannot reliably establish whether a device has been modified.

Customers who bought devices from CryptoBilis during the specified period are eligible for a replacement wallet shipped directly by Trezor or a voucher covering the cost of a new device.

They have been asked to retain their existing hardware and contact the company’s support team to arrange a replacement.

Trezor warned that scammers could exploit the incident through fraudulent emails, letters and phone calls. Customers were reminded never to disclose their recovery phrases, including to anyone claiming to represent the company’s support team.

The investigation is being conducted with assistance from SEAL 911, the Security Alliance’s emergency response service, which has been advising Trezor on its response to affected customers.