Trezor Warns Of Malicious Implant In CryptoBilis Wallets

Hardware wallet manufacturer Trezor has advised customers who purchased devices from former reseller CryptoBilis to transfer their funds to new wallets after receiving a report of a suspected malicious implant inside a Trezor Safe 5 device, according to CryptoNews.

The security disclosure, received on October 30, concerns a wallet purchased through CryptoBilis on Tokopedia in August 2026 by a customer in Indonesia. The user reported finding an additional circuit board and cellular module positioned between the device's main board and screen. According to the report, the hidden hardware is capable of capturing recovery phrases displayed during setup and transmitting them over a mobile network whenever the device is connected to power.

Reseller Ties Cut

CryptoBilis was removed as an authorized Trezor reseller on October 9 after Ledger confirmed that some hardware wallets sold through the same vendor had been physically tampered with. Ledger's separate investigation involved devices that similarly featured unauthorized components designed to capture recovery phrases through an LTE connection.

While Trezor has not yet physically examined the reported Indonesian device, the company considers the disclosure credible based on photographs and video interviews. No customer losses have been reported to Trezor in connection with the reseller.

Security Recommendations

Trezor has advised anyone who purchased any model from CryptoBilis since March 2026 to create a new wallet using a completely new recovery phrase. The company noted that importing an existing recovery phrase into another wallet would not remove the risk of exposure.

Eligible buyers have been offered replacement hardware shipped directly by Trezor or vouchers covering the cost of a new device. Security Alliance emergency response service SEAL 911 is assisting Trezor with its response.

Key Facts

• Trezor received a security report on October 30 regarding a Trezor Safe 5 device purchased via CryptoBilis on Tokopedia in August 2026.
• The suspected implant features an extra circuit board, cellular module, and antenna capable of capturing recovery phrases.
• CryptoBilis was dropped as an authorized Trezor reseller on October 9 following a related tampering incident involving Ledger devices.
• Trezor is offering replacement devices or vouchers to customers who bought hardware from the reseller from March 2026 onward.