Trezor is urging customers who bought hardware wallets supplied by CryptoBilis from March 2026 onward to move their cryptocurrency to new wallets.
The warning follows a credible report of a suspected hardware implant in a Trezor Safe 5.
The company has not yet received the device for examination, and no CryptoBilis customer has reported stolen funds to Trezor. However, it issued the October 30 warning before laboratory confirmation to give potentially affected users time to secure their assets.
The disclosure came from a customer in Indonesia who purchased the Safe 5 through CryptoBilis on Tokopedia in August. Trezor received the report on October 28, reviewed photographs, and interviewed the customer by video call. The owner had already transferred his funds elsewhere before discovering the suspected implant.
Trezor makes cryptocurrency hardware wallets that protect private keys and let owners authorize transactions. A wallet’s recovery phrase, also called a seed or wallet backup, lets you restore access if the device is lost. Stealing that phrase can therefore let an attacker access the assets without possessing the original wallet.
Suspected implant targets the screen
According to the customer’s report, an additional circuit board was installed between the Safe 5’s main board and screen, accompanied by a cellular module and antenna. The hardware allegedly reads information displayed on the screen, including the recovery phrase, and transmits it over a mobile network whenever the wallet is plugged in.
Trezor has not verified those capabilities, and it is arranging shipment of the device to its laboratory. The company has not identified the attackers and is working with Ledger and other parties investigating the incidents.
The report follows the supply chain attack involving Ledger wallets sold by CryptoBilis, formerly an authorized reseller for both manufacturers in Southeast Asia. Ledger began investigating customer fund losses on October 9 and subsequently confirmed physical implants that captured recovery phrases and transmitted them over cellular networks.
Trezor removed CryptoBilis from its reseller network on October 9. It says it has received no reports involving other Trezor resellers.
In an earlier letter to partners, Chief Commercial Officer Danny Sanders announced plans to substantially reduce Trezor’s reseller network so the company could closely check every remaining partner. Resellers receiving the letter would lose authorization on January 1, 2027, with new stock shipments stopped immediately but remaining inventory permitted to be sold until that date.
Sanders stressed that Trezor had no evidence of compromised devices at the time. The company also outlined closer checks on how partners source, store, and handle wallets, alongside an updated legal framework.
New recovery phrases required
Trezor’s guidance covers every model CryptoBilis supplied from March 2026 onward, including purchases through Tokopedia or other stores carrying its inventory.
Customers already using these devices should transfer funds to a newly created wallet with a new recovery phrase. Restoring the existing backup on another device does not address possible exposure. If another secure hardware wallet is unavailable, Trezor recommends temporarily using a familiar software wallet or exchange and checking the full receiving address before transferring.
Unused devices should remain uninitialized, and owners should never enter an existing recovery phrase on them. Trezor advises against opening or weighing devices to check for tampering, as neither provides a dependable consumer test.
Eligible buyers can contact Trezor Support for a replacement shipped directly or a voucher covering a new device.
Leave a Reply