TLDR:
- Trezor hardware wallets purchased from CryptoBilis since March 2026 are subject to a security warning after a suspected implant report.
- Trezor has not examined the reported Safe 5 device, and no CryptoBilis customer has reported losing funds to the company.
- The suspected implant could capture recovery phrases and transmit them over a mobile network, but its capabilities remain unverified.
- Affected buyers should move funds to a new wallet with a fresh recovery phrase and can request a replacement device or voucher.
Trezor hardware wallets sold through former reseller CryptoBilis face a security warning after a customer reported a suspected implant. The company urged buyers who purchased any model from the reseller since March 2026 to move funds to a new wallet.
The new wallet must have a fresh recovery phrase. Trezor has not physically examined the reported device or confirmed the alleged modification.
No CryptoBilis buyer has reported losing funds to the company, which described the disclosure as credible. Its security team plans to inspect the device in its laboratory. The company is offering eligible customers a replacement wallet or voucher.
What the Trezor Hardware Wallets Report Says About the Implant
On October 28, Trezor received a report about a Safe 5 bought on Tokopedia in August. The customer in Indonesia reported finding an extra circuit board between the device’s main board and screen.
Based on the customer’s description, the component includes a cellular module and an antenna. It may read information shown on the screen, including the recovery phrase, and transmit it when connected to power. Trezor reviewed photos and interviewed the customer by video.
Recovery phrases serve as backups for Trezor hardware wallets. Anyone who obtains those words could restore a wallet elsewhere and access its funds without possessing the original device. The customer had moved his funds before discovering the suspected implant.
Trezor removed CryptoBilis from its reseller network on October 9 after Ledger investigated losses among customers. Ledger later confirmed an unauthorized implant in an affected device.
Ledger’s security team found that the component could capture recovery phrases and send them over a mobile network. It is unknown whether the same people are behind both incidents.
Four Trezor hardware wallets bought from CryptoBilis were inspected before the report, including two Safe 5 devices. The other two were a Safe 3 and a Safe 7, and none showed signs of tampering.
Arkham Intelligence estimated that a Ledger-linked drainer stole $95.35 million from 1,486 addresses between October 7 and 9. Ledger has not independently confirmed that total, and Trezor has not linked those losses to its devices.
Separately, Singapore police reported S$3.5 million in losses across at least two cases involving tampered Ledger devices bought from retailers. Preliminary investigations found components that could capture recovery phrases or private keys.
What CryptoBilis Customers Should do to Protect their Funds
Customers who purchased Trezor hardware wallets from CryptoBilis since March should create a separate wallet with a new recovery phrase. The phrase must be generated on a trusted device or in another secure wallet, not on the suspected hardware.
Transferring an existing recovery phrase to another device does not eliminate the danger if that phrase was exposed. Users must send their assets to addresses controlled by the newly created wallet, the company said.
For those without another secure hardware wallet, Trezor suggested temporarily using a familiar software wallet or cryptocurrency exchange. It advised customers to check the full receiving address before making a transfer.
The warning covers Trezor hardware wallets bought since March from CryptoBilis or stores supplied by the reseller. Buyers unsure of their device’s origin can check their receipt or contact Trezor support.
Owners of uninitialized Trezor hardware wallets from CryptoBilis should not set them up or enter an existing recovery phrase. Trezor warned against opening or weighing devices to check for tampering, since weight differences are inconclusive.
Eligible buyers can request a replacement shipped directly by Trezor or a voucher covering a new device. The company asked them to keep their hardware and contact its support team to arrange the replacement.
Trezor also warned that scammers could exploit the incident through fake emails, calls, or letters. Support staff will never ask customers to share their recovery phrase.
