Trezor has issued an urgent warning to customers who purchased its hardware wallets from reseller CryptoBilis, following a credible report of a sophisticated hardware implant found in a Trezor Safe 5 device. The incident was reported on October 28 by a customer in Indonesia through Trezor’s responsible disclosure program. The affected device was bought from CryptoBilis via the Indonesian e-commerce platform Tokopedia in August 2026.
According to the report, which Trezor states it has not yet physically verified, the implant consists of an extra circuit board fitted between the device's main board and its screen. This module includes a cellular antenna designed to read information displayed on the screen, such as wallet backup phrases, and transmit it over a mobile network whenever the device is plugged in. Trezor noted that while they have not examined the specific device, the description and video interview provided by the reporter appear sufficiently sophisticated to warrant immediate action rather than waiting for lab confirmation.
In response, Trezor removed CryptoBilis as an authorized reseller on October 9, after rival manufacturer Ledger began investigating similar losses among its own customers who used devices from the same reseller. Ledger’s security team previously identified implants in their devices sold through CryptoBilis that operated similarly by capturing recovery phrases during setup. Although no loss of funds has been reported to Trezor regarding this specific incident, the company urged anyone who bought a Trezor wallet from CryptoBilis since March 2026 to immediately move their assets to a new wallet with a fresh recovery phrase. Customers are advised not to reuse old phrases and to contact Trezor Support for replacements if needed.
This development highlights the critical vulnerability inherent in third-party distribution channels for self-custody hardware. While hardware wallets are designed to isolate private keys from online threats, physical supply chain attacks bypass these digital safeguards entirely. The similarity between the Trezor report and prior findings at Ledger suggests a targeted campaign against users purchasing through specific Southeast Asian resellers, indicating that threat actors are increasingly focusing on the point of sale rather than software exploits.
The decision by Trezor to warn customers before verifying the hardware implant demonstrates a risk-management approach prioritizing user safety over reputational caution. However, it also underscores the difficulty consumers face in distinguishing legitimate devices from tampered ones without specialized forensic tools. For the broader market, this incident reinforces the necessity for manufacturers to enforce stricter vetting of regional partners and potentially implement more robust anti-tamper mechanisms or serial number verification processes accessible to end-users.
