Trezor has issued a security warning for hardware wallets purchased through former reseller CryptoBilis since March 2026 following a customer report of a suspected implant discovered in a device.
On October 28, Trezor received a report from an Indonesian customer who purchased a Safe 5 device on Tokopedia in August. The customer identified an extra circuit board between the device's main board and screen, which included a cellular module and antenna. Based on the customer's description, the component could read information displayed on the screen, including recovery phrases, and transmit the data when connected to power.
Trezor reviewed photographs and conducted a video interview with the customer but has not physically examined the reported device. No CryptoBilis customer has reported losing funds to date, though the company described the disclosure as credible and plans to inspect the device in its laboratory.
Implications for Recovery Phrases
Recovery phrases serve as backups for Trezor wallets. Anyone obtaining these words could restore a wallet and access its funds without possessing the original device. The customer in the reported incident had moved funds before discovering the suspected implant.
Trezor removed CryptoBilis from its reseller network on October 9 after Ledger investigated customer losses at that reseller. Ledger later confirmed an unauthorized implant in one of its affected devices and determined the component could capture recovery phrases and transmit them over a mobile network. It remains unknown whether the same parties are responsible for both incidents.
Four Trezor wallets purchased from CryptoBilis were inspected prior to this report, including two Safe 5 devices, one Safe 3, and one Safe 7. None showed signs of tampering.
Recommended Actions for Customers
Trezor advises customers who purchased devices from CryptoBilis since March to create a new wallet with a fresh recovery phrase generated on a trusted device or separate secure wallet. Customers should transfer assets to addresses controlled by the newly created wallet rather than transferring the original recovery phrase, as doing so would not eliminate risk if the phrase was compromised.
For those without access to another secure hardware wallet, Trezor suggested temporarily using a software wallet or cryptocurrency exchange while arranging a replacement. The company emphasized checking the full receiving address before transferring funds.
Customers with uninitialized Trezor devices from CryptoBilis should not set them up or enter an existing recovery phrase. Trezor warned against opening or weighing devices to check for tampering, as weight differences alone are not conclusive.
Eligible buyers can request a replacement device shipped directly by Trezor or receive a voucher toward a new purchase. Customers should contact Trezor support to arrange the replacement while retaining their original hardware.
Trezor cautioned that scammers could exploit the incident through fraudulent communications. The company stated that support staff will never request recovery phrases from customers.
