Trezor is warning customers who bought any of its hardware wallets from Southeast Asian reseller CryptoBilis from March 2026 onward to move their assets to a newly created wallet with a new recovery phrase.
The notice follows an October 28 responsible disclosure involving a Trezor Safe 5 purchased through CryptoBilis on Tokopedia in August. The customer reported finding an extra circuit board between the wallet’s main board and display, with a cellular module and antenna that may be able to capture information shown on the screen and transmit it over a mobile network.
Trezor has not yet received the device for laboratory examination, so the implant remains unconfirmed. The company reviewed photographs and interviewed the customer by video, however, and considers the report credible enough to issue an immediate warning. It says no Trezor customer has reported losing funds through this incident.
The company’s October 30 security notice applies to every Trezor model supplied by CryptoBilis, not only the Safe 5. Customers who bought from other resellers are not currently included.
What CryptoBilis buyers should do now
The important distinction is between moving a wallet and restoring the same wallet on different hardware. If a compromised device displayed the recovery phrase during setup, moving that phrase to a clean device preserves the same potentially exposed keys. Trezor’s guidance is to create an entirely new wallet with a new recovery phrase, then transfer the assets to addresses controlled by that new wallet.
Before taking action, buyers should check the seller on their receipt or marketplace order history. The warning covers CryptoBilis purchases from March 2026 onward, including the reseller’s Tokopedia store and any storefront supplied by CryptoBilis.
- Stop using the suspect wallet for ordinary transactions. If it has not been initialized, do not set it up and do not enter an existing recovery phrase into it.
- Obtain a trusted destination. The best option is a new hardware wallet from a known source. Trezor says a familiar software wallet or exchange can serve as a temporary destination if clean hardware is not available.
- Create a new wallet and recovery phrase. Do not restore the phrase generated or entered on the CryptoBilis device.
- Verify the destination address carefully. Compare the complete receiving address on the trusted device before transferring funds. A small test transaction can reduce the risk of an addressing mistake before moving a larger balance.
- Move all assets and review the old addresses. Tokens on different networks may require separate transfers, and decentralized-finance positions or NFTs may need their own handling.
- Contact Trezor through its official support site. Eligible buyers can request a replacement shipped directly by Trezor or a voucher for a new device. Keep the device and proof of purchase for the investigation.
Users should also expect opportunistic phishing. Trezor will not ask for a recovery phrase, and a message, call or physical letter that requests one should be treated as fraudulent.
How the reported implant could bypass normal checks
The reported board appears to target the display path rather than the wallet’s secure element or firmware. During setup, a hardware wallet shows the recovery phrase on its own screen so the words do not have to pass through a connected computer. A board inserted between the main board and display could observe that trusted output after the wallet generated it.
According to Trezor’s account, the added hardware included its own cellular connection and could transmit captured screen content whenever the wallet was plugged in. That would make the attack independent of malware on the owner’s computer and potentially useful even when the official application and firmware behaved normally.
The company’s current Safe 5 onboarding process includes a secure-element authenticity check. Its setup documentation describes that check as confirming that the device was made by Trezor and has not been altered. The reported attack illustrates a harder boundary: a cryptographic check can validate an authentic secure element and legitimate firmware without necessarily detecting an added board intercepting the display connection.
That is also why Trezor advises owners not to rely on weight or a home inspection. Manufacturing variation can change a device’s weight, and opening a wallet does not provide a dependable test unless the examiner knows the expected board layout and can identify professionally installed components. BleepingComputer reported that the customer noticed the additional board only after opening the unit, but Trezor says weighing cannot confirm or rule out tampering.
The warning grew out of the Ledger investigation
CryptoBilis had been an authorized reseller for several hardware-wallet makers. Ledger began investigating losses connected to devices sold through the company on October 9 and later confirmed physical tampering in some units. Trezor removed CryptoBilis from its authorized network that day, before receiving the Safe 5 report.
Trezor examined four other customer devices obtained during its follow-up and found no tampering in them, according to The Block’s report. That small sample does not establish how many units might be affected. The company has not identified an attacker, confirmed a common source for the Ledger and Trezor devices, or reported evidence involving any reseller outside CryptoBilis.
What remains unknown
The device in the disclosure is still in transit to Trezor’s lab. Until it is examined, the exact circuitry, cellular service, captured data, activation conditions and ability to survive firmware updates remain open questions. There is also no confirmed count of altered Trezor wallets.
The warning is therefore a precaution aimed at a clearly defined group rather than evidence that Trezor’s wider device population has been compromised. For buyers in that group, though, the cost of waiting could be the continued exposure of a recovery phrase. Replacing the wallet without replacing the phrase does not close that risk.
