SECURITY ALERT
First it was Ledger.
Now the same reseller, a different brand.
Trezor says a customer in Indonesia has reported a hardware implant inside a Trezor Safe 5 bought from the former reseller CryptoBilis in August 2026, and is telling anyone who bought a Trezor from CryptoBilis since March 2026 to move their funds to a new wallet, according to a notice on Trezor’s blog on Friday.
The report is not yet confirmed.
Trezor says it has not received the device. It is treating the report as credible “based on the customer’s description and a video interview”.
“No funds have been reported as stolen,” the company says.
According to the report, as described by Cointelegraph and Decrypt, the implant is an extra circuit board that reads what the device shows on its screen, including the recovery phrase, and sends it out over a mobile network.
Trezor says it “appears to operate similarly” to the implant found in Ledger devices sold through CryptoBilis.
What we know so far
- 9 Oct. Trezor removes CryptoBilis, until then an official Trezor reseller in Southeast Asia, as Ledger investigates losses among its customers who bought from the same seller.
- 13 Oct. Ledger’s security team publishes Ledger’s account of how its implant works, two days after it first confirmed an implant.
- 28 Oct. A customer reports the Safe 5 implant through Trezor’s responsible disclosure programme. The device had been bought via the Indonesian shopping platform Tokopedia. The same day, Singapore police said on Wednesday that tampered Ledger wallets from local shops had cost two buyers about S$3.5 million.
- 30 Oct. Trezor publishes its notice.
Trezor has inspected four of its devices bought from CryptoBilis, a Safe 7, two Safe 5s and a Safe 3, and found no sign of tampering, Decrypt reported.
A Trezor spokesperson told Cointelegraph that sales through the reseller were “very small”, without giving figures, and that the company has not established where the tampering occurred.
The spokesperson also said seals and packaging are not enough on their own.
“We’d rather warn people now than wait for confirmation and find out someone lost their funds in the meantime,” chief commercial officer Danny Sanders told Cointelegraph.
If the seal was intact and the box looked right, what exactly was the buyer supposed to check?
What Trezor advises
If you bought a Trezor from CryptoBilis from March 2026 onwards and already use it, Trezor says to move your funds to a new wallet with a new seed as soon as possible.
Restoring the old recovery phrase on another device does not fix it. The phrase itself may be exposed, which is why the recovery phrase is the master key.
If the device is not set up yet, do not set it up, and never enter an existing recovery phrase on it.
Trezor is offering affected buyers a new device or a voucher. It asks them to keep the CryptoBilis device and contact support.
The Security Alliance’s emergency team, SEAL 911, is working with Trezor on the report, the company says.
Protect yourself
- Buy hardware wallets only from the maker or a reseller the maker lists as official today.
- Treat any recovery phrase created on a device from an unofficial or removed seller as exposed.
- Move funds to a new wallet with a newly generated phrase on a device you trust, and check the full receiving address before sending.
- Never share your recovery phrase. Trezor says its support staff will never ask for it.
- Expect phishing that uses this incident, from emails to letters and phone calls, as Trezor warns.
Two brands. One reseller. One customer report so far.
How many sealed boxes are still sitting unopened on a shelf?
Corrections and new evidence: [email protected]
This article is for information only and is not investment advice.