Trezor Warns of Suspected Hardware Implant in Wallet Sold by CryptoBilis

Trezor has warned that a Trezor Safe 5 wallet bought from reseller CryptoBilis reportedly contained an extra circuit board that can send the recovery phrase over a mobile network. The company has not examined the device itself, but says the customer report is credible enough to advise affected buyers. Anyone who bought any Trezor model from CryptoBilis since March 2026 should move their funds to a new wallet with a new recovery phrase.

What the customer reported

The report came in on October 28 from a customer in Indonesia who bought the wallet in August through Tokopedia. According to the report, the extra board sits between the wallet's main board and its screen and includes a cellular module and an antenna. It reads the screen, including the recovery phrase that Trezor calls the wallet backup, and sends it out whenever the device is plugged in.

Trezor has the customer's photos and description and interviewed him by video call. It is arranging for the wallet to be sent to its lab. The customer had moved his funds off the wallet before finding the board, and no CryptoBilis buyer has reported losing funds to Trezor.

Advice for affected buyers

Trezor's advice covers every Trezor model bought from CryptoBilis since March 2026, including devices sold by any store that sold wallets supplied by CryptoBilis, including its Tokopedia store. If you already use the wallet, move your funds to a new wallet with a new recovery phrase as soon as possible. Restoring the old recovery phrase on another device does not help, because a tampered wallet could already have sent that phrase out.

If you have no other secure hardware wallet, move the funds for now to a software wallet or an exchange you know. If you have not set up the wallet, do not set it up and never type your existing recovery phrase into it. Keep the CryptoBilis device and contact Trezor Support; Trezor will ship a new device or give a voucher covering the cost of one. If you are not sure where your device came from, check the seller's name on your receipt or contact Trezor Support.

Owners cannot reliably check a device themselves and should not weigh or open it to try it, Trezor says, even though the customer noticed a weight difference. Small differences can have other causes. Trezor also expects scammers to use the incident for phishing through fake emails, letters, and phone calls.

Link to earlier CryptoBilis concerns

Trezor dropped CryptoBilis, its authorized reseller in Southeast Asia, on October 9 after hardware wallet maker Ledger began investigating losses among Ledger customers who had bought from CryptoBilis. Ledger has since said one affected customer's wallet contained an unauthorized hardware implant built to capture the recovery phrase during setup. Trezor says the board reported in its Safe 5 appears to work like the implants seen in Ledger devices, but it will not compare the two while investigations continue because each maker builds its devices differently. It does not know who is responsible.

Singapore police advisory

Separately, the Singapore Police Force said in an advisory on October 28 that Ledger hardware wallets bought from some retail stores in Singapore contained malicious hardware components. At least two cases have been reported since September 10. The components could capture users' recovery phrases or private keys. Police investigations are ongoing, and Ledger is reviewing the affected cases.

Sources: The Hacker News