Trezor has told anyone who bought one of its hardware wallets from reseller CryptoBilis since March 2026 to move their funds. The warning follows a customer’s report of a Trezor CryptoBilis implant: an extra circuit board hidden inside a Safe 5. The company said on Friday, October 30, that it hasn’t examined the device yet but is treating the report as credible. It added that no CryptoBilis buyer has reported a loss of funds to it.
Key Takeaways
- A customer in Indonesia reported a suspected implant in a Trezor Safe 5 bought from CryptoBilis via Tokopedia in August 2026.
- Trezor hasn’t received the device, but says the report is credible and the implant appears to work like the one found in Ledger devices.
- Trezor’s guidance: CryptoBilis buyers since March 2026 should move funds to a new wallet with a new recovery phrase.
- No CryptoBilis buyer has reported a loss of funds to Trezor so far.
What happened with the Trezor CryptoBilis implant
On October 28, Trezor’s security team received a responsible disclosure about a single Safe 5 bought from CryptoBilis in August, according to the company’s official blog post. Until this month, CryptoBilis was an official Trezor reseller in Southeast Asia.
The report describes a board fitted between the device’s main board and its screen, carrying a cellular module and an antenna. Decrypt reported that, according to the report (which Trezor has not verified), the board reads what the screen shows, including the wallet backup. It then sends that data over a mobile network whenever the device is plugged in.
“What we’ve seen looks sophisticated enough that we decided to warn customers now. Waiting for lab confirmation would leave CryptoBilis buyers exposed in the meantime.” (Trezor, via Decrypt)
Trezor CCO Danny Sanders made the same point to The Block: “We’d rather warn people now than wait for confirmation and find out someone lost their funds in the meantime.”
What’s confirmed and what isn’t
Confirmed by Trezor: the disclosure, the date and place of purchase, the warning to buyers since March 2026, and that no CryptoBilis buyer has reported a loss to it. Trezor also said buyers should not reuse the old recovery phrase on any device, and that those who haven’t set up their device yet shouldn’t use it. Affected customers can keep their CryptoBilis device and contact Trezor Support for a replacement, the company said.
Still unclear: whether the implant works as described, who’s behind it, and where the tampering happened. A Trezor spokesperson said the company has not established where the tampering took place and is reviewing its hardware protections, Cointelegraph reported. The spokesperson also acknowledged that seals and packaging aren’t sufficient on their own.
Background and the Ledger case
Trezor dropped CryptoBilis as a reseller on October 9, after Ledger began investigating losses among its own CryptoBilis customers. According to crypto.news, Trezor has since inspected four of its devices bought from the reseller (a Safe 7, two Safe 5s and a Safe 3) and found no evidence of tampering. The newly reported Safe 5 is a different unit.
Ledger’s case is further along. On October 10, it confirmed an unauthorized hardware implant in an affected user’s device. Its Donjon team found that the implant reads the 24-word recovery phrase from the screen during setup and sends it out over LTE. Trezor says the new report “appears to operate similarly,” but it won’t draw comparisons while investigations continue and doesn’t know who is behind it.
The reported losses in the Ledger case are large. ForkLog cited researchers at YFarmX counting 530 affected addresses and $103.4 million in total losses. CryptoBilis has suspended sales and shipments of hardware wallets of all brands in Indonesia, Malaysia and the Philippines. Ledger has also asked resellers in Southeast Asia and Hong Kong to pull its devices, and The Hacker News reported that MediaMarkt Saturn paused Ledger sales after a customer in Germany reported an implant.
This isn’t Trezor’s first partner problem this year. In August, it disclosed that a breach at shipping provider ShipMonk had exposed data of nearly 14,000 U.S. customers, Decrypt noted. That figure grew by another 67,000 in September.
Market reaction
Crypto prices were lower on Friday, though there’s no evidence the Trezor CryptoBilis implant warning moved the broader market. The Crypto Fear & Greed Index read 30 (“Fear”) on October 30.
| Asset | Price (Oct 30, 10:31 UTC) | 24h change | 7d change |
|---|---|---|---|
| Bitcoin (BTC) | $77,324 | -3.42% | -5.01% |
| Ethereum (ETH) | $2,227.53 | -3.75% | -7.38% |
| BNB | $700.93 | -5.41% | -5.66% |
| XRP | $1.25 | -3.04% | -5.48% |
| Solana (SOL) | $96.59 | -3.39% | -7.46% |
Bitcoin traded between $76,443 and $81,840 over the 24 hours to 10:31 UTC, according to CoinGecko data. Crypto remains volatile, and losses can be total.
What to watch next
The key event is Trezor receiving and analysing the Safe 5, which should show whether the implant exists as described. After that, watch for any reported losses from Trezor users, any attribution of the attacker, and evidence of where in the supply chain the devices were opened.
Changes to Trezor’s hardware protections are also worth tracking, given its admission that seals and packaging aren’t enough on their own. A statement from CryptoBilis would add clarity. Trezor’s guidance rests on the idea that a recovery phrase displayed on a compromised device may already be exposed, even if the box looked sealed.
FAQ
What is the Trezor CryptoBilis implant?
It’s a suspected extra circuit board with a cellular module and antenna, reported inside a Trezor Safe 5 sold by CryptoBilis. According to the report, which Trezor hasn’t verified, it reads the wallet backup from the screen and transmits it over a mobile network.
Who does Trezor’s warning apply to?
It applies to anyone who bought a Trezor wallet from CryptoBilis from March 2026 onwards. Trezor urges them to move funds to a newly created wallet with a new recovery phrase.
Has anyone lost funds from a Trezor device?
As of October 30, 2026, Trezor said no CryptoBilis buyer had reported a loss of funds to it. Ledger, by contrast, has said all its confirmed losses involve devices bought from CryptoBilis.
Sources
- Trezor Warns CryptoBilis Buyers After Report of Hardware Implant in Safe 5 (Decrypt)
- Trezor warns CryptoBilis buyers to move funds over suspected implant (Cointelegraph)
- Trezor reports suspected hardware implant in Safe 5 sold by CryptoBilis (The Block)
- Implant reported in a Trezor sold by CryptoBilis (trezor.io)
- Trezor warns of suspected hardware implant in CryptoBilis wallet (crypto.news)
- Trezor Warns CryptoBilis Buyers Over Suspected Wallet Implant (cointelegraph.com)
- Ledger confirms spy chip implant behind wallet crypto thefts (www.bleepingcomputer.com)
- Ledger: Implant in CryptoBilis-sold wallets transmitted recovery phrases over LTE (forklog.com)
- Ledger Finds Unauthorized Hardware Implant in CryptoBilis-Sold Wallet Amid Fund Theft Reports (thehackernews.com)
This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrencies are highly volatile; always do your own research before investing.
For advertising inquiries, please email . [email protected] or Telegram
