Trezor warns of a suspected hardware implant in a wallet sold by reseller CryptoBilis

Trezor has issued a warning to customers of the reseller CryptoBilis. According to a customer report, a Trezor Safe 5 hardware wallet bought from this seller contained an extra circuit board that transmits the recovery phrase over a mobile network.

What the customer found

Trezor said in a blog post on October 30 that the report arrived two days earlier from a customer in Indonesia. He bought the wallet from CryptoBilis in August through the Tokopedia marketplace.

As described by the customer, the board, carrying a cellular module and an antenna, sits between the wallet's main board and its screen. It reads what is shown on the screen, including the recovery phrase (Trezor's term is the wallet backup), and sends it out whenever the device is plugged in.

Trezor has the customer's photos and description, has interviewed him on a video call, and is arranging for the wallet to be shipped to its lab. The company considers the report credible enough to warn users before lab confirmation: "Waiting for lab confirmation would leave CryptoBilis buyers exposed in the meantime."

No CryptoBilis buyer has reported lost funds to Trezor, though the company cannot see what customers hold in their wallets. The Indonesian customer had moved his funds off the device before he discovered the board.

Recommendations

The warning covers every Trezor model bought from CryptoBilis since March 2026, including from any store that sold devices supplied by CryptoBilis and from its store on Tokopedia:

• if you already use the wallet, move your funds to a new wallet with a new recovery phrase as soon as possible. Restoring the old phrase on another device will not help, since a tampered wallet may already have sent it out;
• if you have no other secure hardware wallet, temporarily move the funds to a software wallet or an exchange you know;
• if you have not set up the wallet, do not set it up, and never enter your existing recovery phrase into it;
• keep the device and contact Trezor Support — the company will send a new wallet or a voucher covering its cost;
• if you are unsure where your device came from, check the seller's name on the receipt or contact Support.

Owners cannot reliably check a device themselves, and Trezor advises against weighing or opening it. The customer noticed a weight difference, but small variations can have other causes. The company also expects scammers to exploit the incident for phishing through fake emails, letters and phone calls. As of October 30, there were no reports involving any other reseller.

The Ledger connection

Trezor dropped CryptoBilis, its authorized reseller in Southeast Asia, on October 9, after Ledger began investigating losses among its own customers who had bought from the same seller. Ledger later said one affected customer's wallet contained an unauthorized hardware implant designed to capture the recovery phrase during setup.

Trezor says the board in the Safe 5 appears to work like the implants found in Ledger devices. It will not compare the two while investigations continue, however, because each manufacturer builds its devices differently. Trezor does not know who is responsible.

Separately, the Singapore Police Force warned on October 28 that Ledger hardware wallets bought from some retail stores in Singapore contained malicious hardware components capable of capturing recovery phrases or private keys. At least two cases have been reported since September 10. Police investigations are ongoing, and Ledger is reviewing the affected cases.

Source: The Hacker News