From CryptoPotato · By Chayanika Deka
Trezor has now warned customers who bought hardware wallets from CryptoBilis on or after March 2026 to move their funds to a newly created wallet with a new seed as soon as possible.
The latest security alert comes after reports of a possible hardware implant inside a Trezor Safe 5 emerged.
Hidden Circuit Board, Cellular Module
CryptoBilis was an official Trezor reseller in Southeast Asia until October 2026, and the company is now treating the report as credible, although it has not yet received the device to confirm the findings. The issue came to light on October 9, when Ledger began investigating reports of fund losses among customers who had purchased hardware wallets from CryptoBilis. Ledger later confirmed that some devices had been physically tampered with in a sophisticated supply chain attack.
Since CryptoBilis was also an authorized Trezor reseller, Trezor removed the company from its list of official sellers that same day and began investigating customer devices. On October 28, its security team received a responsible disclosure from a customer in Indonesia who purchased a Trezor Safe 5 through Tokopedia in August 2026. According to the report, an extra circuit board had been fitted inside the device, between the main board and the screen, which contained a cellular module and an antenna.
According to the report, the implant can read whatever appears on the screen, including the wallet backup, and transmit that information over a mobile network whenever the device is plugged in. Trezor has received photos and interviewed the customer over a video call, but the device has not yet arrived at its laboratory for examination.
The company said it decided to warn customers rather than wait for laboratory confirmation, as that could leave affected buyers exposed. For those already using an affected device, Trezor said that simply using the wallet backup from the potentially tampered device on another hardware wallet will not fix the problem. If a secure hardware wallet is not available, customers can temporarily move their funds to a software wallet or an exchange they are familiar with, while carefully checking the full receiving address before sending anything. Those who have not set up their device should not use it or enter an existing wallet backup on it.
The hardware wallet maker also warned that scammers may use the incident to launch phishing attacks through fake emails, letters and phone calls. All customers who purchased from CryptoBilis during the affected period are eligible for a replacement Trezor shipped directly by the company or a voucher covering the cost of a new device. Customers should keep their CryptoBilis device and contact Trezor Support to arrange this.
So far, no stolen funds have been reported, and the customer who discovered the implant had already moved his funds before finding it. Trezor also added that it does not know who is behind the attack and has no reports involving other resellers or regions.