Trezor has warned customers who bought its hardware wallets from the reseller CryptoBilis that a device may contain a hidden implant, after a responsible disclosure report reached the company on October 28. The company’s October 30 notice says the report, which it has not verified, describes an extra circuit board between the main board and the screen of a Trezor Safe 5 bought from CryptoBilis in August through its Tokopedia store.
According to the report, the board carries a cellular module and antenna and captures what the screen shows, including the wallet backup, then sends it over a mobile network whenever the device is connected. Trezor says the device is still on its way to its lab, so the implant’s existence and function are unconfirmed, and the attackers’ identity is unknown.
CryptoBilis was an authorized Trezor reseller in Southeast Asia until Trezor removed it on October 9, after Ledger began investigating tampered devices sold by the same reseller. Trezor’s guidance covers any Trezor model bought from CryptoBilis from March 2026 onward. Trezor says it has no evidence of stolen funds, no CryptoBilis buyer has reported a loss, and the reporter moved their funds off the device before discovering the implant.
Owners of affected devices are told to move funds to a new wallet with a new seed as soon as possible, since restoring the old backup on another device does not fix the problem. Buyers who have not set up a device should not do so and should never enter an existing recovery phrase on it. Trezor is offering a replacement device or a voucher, warns of phishing that exploits the incident, and says weighing or opening a device is not a reliable check.