Trezor Warns of Suspected Hardware Implant in One of Its Wallets Sold by CryptoBilis
A Trezor Safe 5 hardware wallet bought from the reseller CryptoBilis has an extra circuit board that sends out the recovery phrase over a mobile network, a customer has reported.
A Trezor Safe 5 hardware wallet bought from the reseller CryptoBilis has an extra circuit board that sends out the recovery phrase over a mobile network, a customer has reported.
Trezor said in a blog post on October 30 that the report came in two days earlier from a customer in Indonesia.
It is telling everyone who bought a Trezor from CryptoBilis since March 2026 to move their funds to a new wallet with a new recovery phrase; the board sits between the wallet's main board and its screen, with a cellular module and an antenna, according to the report.
Trezor has the customer's photos and description and has interviewed him on a video call.
Trezor's advice covers every Trezor model bought from CryptoBilis since March 2026, from any store that sold devices CryptoBilis supplied, including its store on Tokopedia: Owners cannot reliably check a device themselves and should not weigh or open it to try it, according to Trezor.
Ledger has since said that one affected customer's wallet contained an unauthorized hardware implant built to capture the recovery phrase during setup.
The customer noticed a weight difference, but small differences can have other causes.
Trezor dropped CryptoBilis, its authorized reseller in Southeast Asia, on October 9, after hardware wallet maker Ledger began investigating losses among Ledger customers who had bought from CryptoBilis.
Police investigations are ongoing, and Ledger is reviewing the affected cases.
Trezor will not compare the two while investigations continue, because each maker builds its devices differently.
What happened
A Trezor Safe 5 hardware wallet bought from the reseller CryptoBilis has an extra circuit board that sends out the recovery phrase over a mobile network, a customer has reported.
Trezor said in a blog post on October 30 that the report came in two days earlier from a customer in Indonesia.
What changed
It is telling everyone who bought a Trezor from CryptoBilis since March 2026 to move their funds to a new wallet with a new recovery phrase; the board sits between the wallet's main board and its screen, with a cellular module and an antenna, according to the report.
Who is affected
Trezor has the customer's photos and description and has interviewed him on a video call.
Trezor's advice covers every Trezor model bought from CryptoBilis since March 2026, from any store that sold devices CryptoBilis supplied, including its store on Tokopedia: Owners cannot reliably check a device themselves and should not weigh or open it to try it, according to Trezor.
Why it matters
Ledger has since said that one affected customer's wallet contained an unauthorized hardware implant built to capture the recovery phrase during setup.
The customer noticed a weight difference, but small differences can have other causes.
Response
Trezor dropped CryptoBilis, its authorized reseller in Southeast Asia, on October 9, after hardware wallet maker Ledger began investigating losses among Ledger customers who had bought from CryptoBilis.
Police investigations are ongoing, and Ledger is reviewing the affected cases.
What security teams should do
Trezor will not compare the two while investigations continue, because each maker builds its devices differently.
Attribution
The Hacker News: A Trezor Safe 5 hardware wallet bought from the reseller CryptoBilis has an extra circuit board that sends out the recovery phrase over a mobile network, a customer has reported.