Trezor Says Move Your Funds to a New Wallet If You Bought From CryptoBilis Since March. A Suspected Cellular Implant Was Found Inside a Safe 5.
If you bought any Trezor from the reseller CryptoBilis since March 2026, Trezor says move your funds to a new wallet with a new recovery phrase now. A customer in Indonesia reported a Trezor Safe 5 with an extra circuit board containing a cellular module and antenna, which he says reads the screen, recovery phrase included, and sends it out over a mobile network whenever the device is plugged in. Trezor has not yet examined the device and says it does not know who is responsible.
What was reported
Trezor's October 30 blog post says the customer bought the device in August through Tokopedia, noticed it felt different in weight, opened it and found a board between the main board and the screen. He had moved his funds off the wallet before he found it. Trezor has his photos and description, interviewed him by video call, and plans to send the device to its lab. It chose not to wait for lab confirmation, saying that would leave CryptoBilis buyers exposed in the meantime.
CryptoBilis was Trezor's authorized reseller in Southeast Asia until Trezor dropped it on October 9. That followed an investigation by Ledger, which found that one affected customer's wallet held an unauthorized implant designed to capture the recovery phrase during setup. Trezor says the Safe 5 board appears to work like the Ledger implants but will not compare them while investigations continue, because the makers build devices differently. Separately, the Singapore Police Force said on October 28 that Ledger wallets from some Singapore retail stores contained malicious components that could capture recovery phrases or private keys, with at least two cases since September 10.
Trezor has received no reports of funds lost by CryptoBilis buyers, though it cannot see customer holdings. As of October 30 no reports involve any other reseller.
What Trezor says to do
Active users: move funds to a new wallet with a new recovery phrase as soon as possible. Restoring the old phrase on another device does not help, since the phrase may already have been sent.
If you have no other secure hardware wallet: temporarily move funds to a software wallet or an exchange you trust.
Unused devices: do not set them up, and never enter an existing recovery phrase into them.
Keep the device and contact Trezor Support, which will ship a replacement or a voucher.
If unsure of origin, check the seller's name on your receipt or contact Trezor Support.
Do not open or weigh the device to test it. Owners cannot reliably verify it themselves.
Trezor also expects scammers to use the incident for fake emails, letters and calls. Be suspicious of anyone who contacts you first about it.
Ours, not Trezor's: buy a hardware wallet directly from the maker or a reseller the maker names on its own site, and keep the receipt.
What we hold, and what we don't
Nothing for the feed. The only indicator is physical, an extra board with a cellular module and antenna, and no network indicators were published. This is the kind of case where the supply chain is the attack surface and no sensor on a network can see it.
Limits
This rests on The Hacker News' October 30 report of Trezor's blog post and the Singapore police advisory. We did not read Trezor's post, inspect a device or confirm any of the claims. Trezor itself has not confirmed the board in the lab, and the weight difference the customer noticed can have other causes.
Five percent of this is wrong somewhere. It always is. The numbers will move again before you finish reading.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments