Trezor has warned customers about a potentially compromised device sold through CryptoBilis, a former authorized reseller that was also linked to a recent security incident affecting rival manufacturer Ledger.
According to Trezor's Friday announcement, the company's security team received a credible report of a malicious hardware implant inside a Trezor Safe 5 purchased from CryptoBilis in August through Indonesian e-commerce platform Tokopedia. The customer reported the discovery to Trezor on October 28.
Details of the Suspected Implant
The implant reportedly consists of an additional circuit board installed between the wallet's main board and screen, equipped with a cellular module and antenna. According to Trezor, the device allegedly captures information displayed on the screen, including the wallet's recovery phrase, and transmits it over a mobile network when connected to power.
Trezor said it has reviewed photographs and interviewed the customer but has not yet physically examined the device. The company is treating the report as credible while awaiting laboratory verification. No funds have been reported stolen from Trezor customers in connection with the suspected compromise.
Connection to Ledger Security Incident
The discovery follows a major security incident involving Ledger, which began investigating customer losses on October 9 after reports emerged that devices distributed through CryptoBilis had been physically modified. Ledger subsequently confirmed that some devices had been compromised in a sophisticated supply chain attack, with reported user cryptocurrency losses estimated at $93 million.
Ledger attributed the operation to a highly organized criminal group that reportedly spent millions of dollars orchestrating the attack. Trezor has not established whether the suspected attack on its device was carried out by the same perpetrators responsible for the Ledger compromises.
Recommended Actions and Precautions
Trezor is urging anyone who purchased a Trezor device from CryptoBilis since March 2026 to immediately transfer their cryptocurrency to a new wallet with a newly generated recovery phrase. The company emphasized that simply restoring the potentially compromised wallet's existing recovery phrase on another device would not eliminate the risk.
Customers who have not yet initialized their devices purchased from CryptoBilis are being advised against using them. Affected buyers are eligible for a replacement device shipped directly by the company or a voucher covering the cost of a new wallet.
Trezor said it has received no similar reports involving other resellers and is coordinating with Ledger and security researchers as the investigation continues.
Broader Industry Response
Following the Ledger scandal, Trezor announced plans to dramatically reduce its authorized reseller network beginning January 1, 2027, seeking greater control over the distribution of its devices. The warning applies to all Trezor models purchased through CryptoBilis, although the suspected implant has only been reported in a single Safe 5 device.
