Trezor has warned customers who bought its hardware wallets from reseller CryptoBilis to move their funds as soon as possible, after a buyer in Indonesia reported a hardware implant in a Trezor Safe 5 device. The company said it had not yet examined the device but treated the report as credible based on a description and video interview.
The report, filed through Trezor's responsible disclosure program on October 28, describes an extra circuit board fitted between the device's main board and screen. According to the unverified report, the board reads the wallet backup from the screen and transmits it over a mobile network whenever the device is plugged in. Trezor said the implant appears to operate similarly to one discovered earlier by rival hardware wallet manufacturer Ledger, whose Donjon security team found an implant in Ledger devices sold through CryptoBilis that reads the 24-word recovery phrase during setup and sends it out over LTE.
Trezor has not yet received the implanted device. "What we've seen looks sophisticated enough that we decided to warn customers now," the company said. "Waiting for lab confirmation would leave CryptoBilis buyers exposed in the meantime." Trezor has inspected four of its own devices bought from CryptoBilis (a Safe 7, two Safe 5s, and a Safe 3) and found no evidence of tampering.
The company urged anyone who bought a Trezor wallet from CryptoBilis from March 2026 onwards to create a new wallet with a new recovery phrase and move their funds. Buyers who have not yet set up their device should not use it. No CryptoBilis buyer has reported a loss of funds to Trezor.
Trezor delisted CryptoBilis as a reseller on October 9, after Ledger began investigating losses among customers who bought its devices from the reseller. Ledger has confirmed that all confirmed losses in its own case involved devices from CryptoBilis, with one victim losing more than 60 Bitcoin, worth about $4.8 million according to blockchain analytics firm Chainalysis.
Analysis
Why This Matters
- A hardware wallet's entire security proposition relies on private keys never leaving the device. An implant that reads the screen directly undermines the foundational trust in self-custody.
- The incident highlights the significant supply chain risks of purchasing hardware wallets through unauthorised or third-party resellers where devices may be intercepted and modified.
- It demonstrates a sophisticated, targeted attack vector against crypto users, potentially part of a broader operation affecting multiple hardware wallet manufacturers.
Background
Cryptocurrency hardware wallets are designed to store private keys offline, generating transaction signatures on the device itself. The security of these devices depends entirely on the integrity of the hardware and the supply chain. In September 2026, Ledger began investigating losses among customers who bought its devices from CryptoBilis, a Southeast Asian reseller, which led to the discovery of a hardware implant that steals recovery phrases. Trezor delisted CryptoBilis in early October and has now received a report of a similar implant in one of its own devices from the same reseller.
Key Perspectives
Trezor: Treats the report as credible and has issued an urgent warning for all affected customers to move their funds, acting before lab confirmation to prevent potential losses.
Ledger: Discovered a nearly identical implant in its own devices from the same reseller and confirmed that all known losses stemmed from CryptoBilis purchases.
What to Watch
- Physical examination of the implanted Safe 5 by Trezor's security team, which could confirm the report and reveal more about the attack's sophistication.
- Further fallout for CryptoBilis, including potential legal action or delisting from other platforms and manufacturers.
- Whether other hardware wallet brands or devices sold through the same reseller show signs of tampering.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedTrezor said, “What we've seen looks sophisticated enough that we decided to warn customers now.”Decrypt: “"What we've seen looks sophisticated enough that we decided to warn customers now," it said.”
- SupportedTrezor said, “Waiting for lab confirmation would leave CryptoBilis buyers exposed in the meantime.”Decrypt: “"Waiting for lab confirmation would leave CryptoBilis buyers exposed in the meantime."”
- SupportedTrezor warned CryptoBilis buyers about a reported hardware implant in a Safe 5.Decrypt: “Trezor Warns CryptoBilis Buyers After Report of Hardware Implant in Safe 5.”
- SupportedA customer in Indonesia reported the implant through Trezor’s responsible disclosure program on October 28.Decrypt: “A customer in Indonesia reported the implant through Trezor's responsible disclosure program on October 28, according to a company .”
- SupportedThe unverified report described an extra circuit board between the device’s main board and screen that reads the wallet backup and sends it over a mobile network when the device is plugged in.Decrypt: “According to the report, which Trezor said it has not verified, the board reads what the screen shows, including the wallet backup, and sends it out over a mobile network whenever the device is plugged in.”
- SupportedTrezor had not received or examined the device but treated the report as credible based on the customer’s description and a video interview.Decrypt: “Trezor has not yet received the device, but said it is treating the report as credible based on the customer's description and a video interview.”
- SupportedTrezor said the reported implant appears to operate similarly to a Ledger implant that reads a 24-word recovery phrase during setup and sends it over LTE.Decrypt: “Ledger's Donjon security team an implant in Ledger devices sold through CryptoBilis that reads the 24-word recovery phrase from the screen during setup and sends it out over LTE. Trezor's blog says the newly reported implant "appears to operate similarly,"”
- SupportedTrezor inspected four of its own CryptoBilis-bought devices—a Safe 7, two Safe 5s and a Safe 3—and found no evidence of tampering.Decrypt: “Trezor has since inspected four of its devices bought from CryptoBilis, a Safe 7, two Safe 5s and a Safe 3, and found no evidence of tampering.”
- SupportedTrezor urged buyers who bought a wallet from CryptoBilis from March 2026 onwards to create a new wallet with a new recovery phrase and move their funds; buyers who have not set up their device should not use it.Decrypt: “Trezor urged anyone who bought one of its wallets from CryptoBilis from March 2026 onwards to move their funds to a newly created wallet with a new recovery phrase as soon as possible, and not to reuse the old phrase on any device. Buyers who have not yet set up their device should not use it.”
- SupportedNo CryptoBilis buyer had reported a loss of funds to Trezor.Decrypt: “No CryptoBilis buyer has reported a loss of funds to Trezor, the company said.”
- SupportedTrezor delisted CryptoBilis as a reseller on October 9, after Ledger began investigating losses among customers who bought its devices from the reseller.Decrypt: “The CryptoBilis incident Trezor CryptoBilis as a reseller on October 9, after rival hardware wallet manufacturer Ledger began investigating losses among customers who bought its devices from the Southeast Asian reseller.”
- SupportedLedger confirmed that all confirmed losses in its case involved CryptoBilis devices, and one victim lost more than 60 BTC, worth about $4.8 million according to Chainalysis.Decrypt: “Ledger has that all confirmed losses involve devices bought from CryptoBilis. One of the largest victims was a scammer who more than 60 BTC, worth about $4.8 million, according to blockchain analytics firm Chainalysis.”
