Trezor urges CryptoBilis buyers to move funds after hardware implant report
The wallet maker warned customers who bought devices from former reseller CryptoBilis since March to transfer their crypto following a tampering report on a Safe 5 model.
Key takeaways
- 1Trezor warned customers who bought devices from former reseller CryptoBilis since March to migrate funds immediately.
- 2An Indonesian customer found an unauthorised circuit board inside a Trezor Safe 5 bought on Tokopedia in August.
- 3The suspected hardware implant can read recovery seed phrases from the screen and send them over a cellular network.
- 4Trezor has not yet physically examined the affected device in its laboratory and reports no customer losses to date.
Trezor told customers who bought devices from former authorised reseller CryptoBilis since March to move their funds on 30 October 2026, after a report of a suspected hardware implant in a Safe 5 unit.
A customer in Indonesia found an unauthorised circuit board inside a Trezor Safe 5 bought on Tokopedia in August. The report said the implant can capture information shown on the device screen, including recovery phrases, and send it over a cellular network.
Trezor chief commercial officer Danny Sanders told Cointelegraph the company has not yet examined the device in its lab. Sanders said the firm considers the report credible and preferred to warn users immediately rather than wait for confirmation while funds were at risk. He told Cointelegraph that the company would rather act now than find out later that someone lost their crypto.
A Trezor spokesperson said sales through CryptoBilis were very small but did not give specific numbers. The spokesperson added that the company has not found where the tampering happened and said factory seals and packaging are not enough to prevent hardware changes.
Trezor said its setup checks look for fake hardware and modified firmware. This implant reads the screen without changing the software. If an attacker gets a recovery phrase, they can use it to open the wallet on another device and take the funds. A stolen phrase gives an attacker full control over the assets.
Ledger confirmed on 9 October that its wallets sold through CryptoBilis also had hardware implants. Singapore police said tampered Ledger devices from that reseller cost users $2.7m. Security researcher Joe Grand told Trezor in August about tampered wallets sold on Facebook and TikTok. Trezor said at the time that its claim of no compromised devices only applied to units sold through authorised resellers. The company then said it would cut its reseller network on 13 October.
Trezor said it has not heard of any customer losses from the CryptoBilis Safe 5 report. The company is now reviewing its hardware security as it looks into the supply chain vulnerability.
Also reported by
Reported and edited by the YourKhabri desk under our editorial policy. Nothing here is investment advice.