Trezor has issued a security alert to customers who bought hardware wallets from CryptoBilis, an authorized reseller in Southeast Asia, on or after March 2026. The company is advising affected users to transfer their funds to newly created wallets with fresh seed phrases as soon as possible.
The warning follows a report of a potentially compromised Trezor Safe 5 device. On October 28, Trezor's security team received a responsible disclosure from a customer in Indonesia who purchased the device through Tokopedia in August 2026. According to the report, an additional circuit board had been installed inside the device between the main board and screen, equipped with a cellular module and antenna.
The implant reportedly can read information displayed on the screen, including wallet backups, and transmit that data over a mobile network when the device is connected to power. Trezor has reviewed photos and conducted a video interview with the customer but has not yet received the device for laboratory examination.
CryptoBilis was removed from Trezor's list of official resellers on October 9, the same day Ledger began investigating reports of compromised devices sold through the same distributor. Ledger later confirmed that some of its devices had been physically tampered with in what authorities described as a sophisticated supply chain attack.
Trezor decided to issue the warning without waiting for laboratory confirmation to prevent prolonged exposure for affected customers. The company stressed that using a wallet backup from a potentially compromised device on another hardware wallet will not resolve the security issue.
For customers who need to move funds immediately and lack access to another secure hardware wallet, Trezor recommends temporarily transferring assets to a software wallet or exchange while carefully verifying receiving addresses before sending any cryptocurrency. Customers who have not yet set up their CryptoBilis device should not use it or import an existing wallet backup onto it.
Trezor cautioned that scammers may exploit the incident to launch phishing attacks through fraudulent emails, letters, and phone calls. All customers who purchased from CryptoBilis during the affected period are eligible for a replacement device shipped directly by Trezor or a voucher to cover the cost of a new wallet.
To date, no stolen funds have been reported, and the customer who discovered the implant had already moved their funds before finding it. Trezor stated it does not know who is responsible for the attack and has received no reports involving other resellers or regions.
The incident comes as hardware wallet security concerns continue to rise. Singapore authorities recently reported that cryptocurrency users lost approximately $3.5 million after using tampered Ledger devices, with at least two confirmed cases occurring since September 10.
