Trezor warns CryptoBilis buyers to move funds after implant report

Trezor has told customers who bought its hardware wallets from the former reseller CryptoBilis from March 2026 onward to move their funds to a newly created wallet with a fresh recovery phrase, after a buyer reported a suspected implant inside a Safe 5, Blockonomi reported.

The customer in Indonesia bought the device through Tokopedia in August 2026 and filed a responsible disclosure on October 28, according to Trezor’s blog post on the reported implant. Trezor said it has reviewed photographs and held a video call with the customer but has not physically examined the device, and that no buyer who used CryptoBilis has reported losing funds to the company.

Key facts

• Trezor received the disclosure on October 28 concerning a Safe 5 bought on Tokopedia in August 2026 by a customer in Indonesia.
• The reported hardware is an extra circuit board placed between the main board and the screen, carrying a cellular module and an antenna, based on the customer’s description.
• Trezor removed CryptoBilis from its reseller network on October 9 after Ledger began investigating losses among that reseller’s customers.
• Four Trezor wallets bought through CryptoBilis were inspected earlier — two Safe 5s, a Safe 3 and a Safe 7 — and none showed signs of tampering.
• Arkham Intelligence estimated that a drainer linked to the Ledger case took $95.35 million from 1,486 addresses between October 7 and 9, a total Ledger has not independently confirmed.

What the reported implant does

As described by the customer, the component could read what the screen displays, including the recovery phrase generated during setup, and transmit it when the device is powered. Trezor said that description is credible enough to act on. Decrypt quoted the company’s reasoning that waiting for laboratory confirmation would leave CryptoBilis buyers exposed; Trezor’s security team is arranging to have the wallet sent in for examination.

Decrypt also reported that Trezor says the reported implant “appears to operate similarly” to the one found in Ledger devices sold through the same reseller, while declining to draw firm comparisons during the investigation. Ledger’s Donjon security team found a component that captured the 24-word phrase from the screen over an LTE connection. Nobody has established who installed either implant or whether the same attackers were involved in both.

How the Ledger case compares

CryptoBilis previously operated as an authorized reseller for both manufacturers in Southeast Asia. crypto.news reported that the hidden hardware in the Ledger case worked separately from the device’s security chip, leaving the normal operating system and transaction signing unchanged — a detail that matters to owners who assume a working wallet is an untampered one.

Singapore police separately reported S$3.5 million in losses across at least two cases involving tampered Ledger devices bought from local retailers, with preliminary findings of components capable of capturing recovery phrases or private keys. Decrypt reported that one of the largest victims in the Ledger case was a scammer who lost more than 60 BTC, worth about $4.8 million according to Chainalysis.

What Trezor is telling owners

The advice covers every Trezor model supplied by CryptoBilis, including devices sold through Tokopedia and other shops that sourced stock from the reseller. Owners should generate a new recovery phrase on a trusted device or another secure wallet and send assets to addresses that wallet controls. Transferring an existing phrase to different hardware does not erase the danger if that phrase was already exposed.

Buyers without a second hardware wallet can move funds temporarily to a familiar software wallet or an exchange, checking the full receiving address first. Anyone holding an uninitialized Trezor from CryptoBilis should not set it up or enter an existing phrase. Trezor also warned against opening or weighing devices to check for tampering, saying weight differences prove nothing — a point that matters because the reporting customer noticed a weight difference.

Eligible buyers can request a replacement shipped directly by Trezor or a voucher covering a new device, and were asked to keep their existing hardware and contact support. Trezor said scammers may exploit the episode through fake emails, calls or letters, and that its support staff will never ask for a recovery phrase. crypto.news reported that SEAL 911, the Security Alliance’s emergency response service, has been advising Trezor on its response.

Why it matters

The warning shifts the practical burden onto buyers in Southeast Asia who bought at retail rather than direct, a channel where tampering can happen after the manufacturer ships. Trezor’s earlier inspections of four devices found nothing, so this is a single unverified report rather than a confirmed batch defect — but the company chose to act before lab results because the potential loss is a full wallet balance.

It also deepens scrutiny of reseller supply chains for both major hardware wallet makers, and follows the August ShipMonk shipping breach that exposed the personal data of U.S. Trezor customers.

What to watch

The next concrete step is delivery of the Safe 5 to Trezor’s laboratory, where its security team will determine whether the described board exists and what it can do. Ledger’s continuing accounting of the $95.35 million figure, which it has not independently confirmed, will also shape how the two cases are compared.

Disclaimer: This article is for information only and is not investment, financial or trading advice. Cryptocurrency prices are highly volatile. Always do your own research.

Sources: Blockonomi, crypto.news, Decrypt