Breach · · 3 min read
Trezor warns buyers from reseller CryptoBilis after a reported hidden implant
Trezor says a customer reported an extra circuit board with a cellular module inside a Safe 5 bought from CryptoBilis. It asks those buyers to move funds to a new wallet.
Trezor makes hardware wallets, small devices that keep the keys to someone’s cryptocurrency offline. On October 30, 2026, it warned that a customer had reported a hidden implant inside a Trezor Safe 5 bought from CryptoBilis, a reseller in Southeast Asia. Trezor hasn’t examined the device yet, but it’s treating the report as credible. If you bought a Trezor from CryptoBilis, here’s what to know.
What happened
In its notice, Trezor says it received a responsible disclosure report on October 28 about a Safe 5 bought from CryptoBilis in August 2026 through the Tokopedia marketplace. The customer, in Indonesia, described an extra circuit board fitted between the main board and the screen, with a cellular module and an antenna. According to the report, which Trezor says it hasn’t verified, the board reads what the screen shows, including the wallet backup (the recovery phrase), and sends it out over a mobile network whenever the device is plugged in.
Trezor says it has seen photos and interviewed the reporter by video, and that its security team will examine the device once it arrives. It says no CryptoBilis buyer has reported losing funds to it, and that the customer who found the implant had already moved his funds.
CryptoBilis was an official reseller for both Trezor and Ledger. Trezor says Ledger began investigating fund losses among customers who bought from CryptoBilis on October 9, and later confirmed that some of those devices had been physically tampered with. Trezor removed CryptoBilis as a reseller the same day, before it had any sign its own devices were involved. Trezor says it won’t compare the two cases while investigations are ongoing and doesn’t know who is behind this.
What this means for you
A hardware wallet is only as safe as the path it took to reach you. This report concerns one device from one reseller, and Trezor says it has no reports involving any other reseller. Still, anyone who bought from CryptoBilis since March 2026 is being asked to act as if their device can’t be trusted.
What you can do
If you bought any Trezor model from CryptoBilis from March 2026 onwards, including through its Tokopedia store:
- If you’re using it, move your funds to a new wallet with a new recovery phrase as soon as you can. Trezor says restoring the old phrase on another device doesn’t fix the problem, because the phrase itself may have been exposed.
- If you haven’t set it up, don’t. And never type your existing recovery phrase into it.
- Don’t try to test it yourself. Trezor says weighing or opening the device isn’t a reliable check.
- Contact Trezor Support for a replacement. Trezor says these buyers can get a new device or a voucher. Keep the CryptoBilis device.
- Never share your recovery phrase with anyone. Trezor says its support will never ask for it, and expects scammers to use this news in fake emails, letters and calls.
How Frame helps
Frame keeps a catalog of known breaches and incidents. Add the ones you were part of to a verified email and Frame shows what each exposed, gives you a short checklist and counts it in your exposure report. Automatic breach lookups aren’t live yet. Frame never collects or stores the leaked records themselves.
Sources
- Trezor, Implant reported in a Trezor sold by CryptoBilis, October 30, 2026
- BleepingComputer, Trezor warns of suspected crypto-theft implant in hardware wallet, October 30, 2026
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.