Trezor Wallet Bought From Reseller CryptoBilis Allegedly Hid a Cellular Implant Leaking Recovery Phrases
Hardware wallets exist to keep private keys off the internet. A report Trezor made public on 30 October 2026 describes a device that did the opposite: a Trezor Safe 5, purchased through the Southeast Asian reseller CryptoBilis, with an unauthorised circuit board inside that allegedly reads the recovery phrase from the screen and transmits it over a mobile network.
What happened
The report reached Trezor on 28 October from a customer in Indonesia who had bought the wallet in August through the Tokopedia marketplace, from CryptoBilis's storefront. When the customer opened the device, he found an additional board wedged between the main board and the display. Based on his photos and description, it carries a cellular modem and an antenna. The implant appears to capture whatever is displayed on screen, including the wallet backup that Trezor users see once as a recovery phrase during setup, and sends it out whenever the device is powered over USB.
Trezor has not yet had the wallet in its own lab. It has interviewed the customer over video, reviewed the images, and is arranging for the unit to be shipped for analysis. The company decided not to wait for that confirmation: it judged the report credible enough that staying quiet would leave other CryptoBilis buyers exposed in the meantime.
Importantly, the customer had already moved his funds elsewhere before discovering the board, and Trezor says no CryptoBilis buyer has reported losses to it so far. Trezor cannot see what its customers hold, so the absence of reports is not proof that nothing was taken.
A pattern, not a one-off
This is not the first time CryptoBilis has come up. Trezor ended its reseller relationship with the company on 9 October, after Ledger started investigating losses among its own customers who had bought devices from the same reseller. Ledger has since stated that at least one affected customer's wallet contained an unauthorised hardware implant designed to capture the recovery phrase during setup.
Trezor says the board found in the Safe 5 seems to behave like the implants reported in Ledger devices, but it is declining to draw a direct comparison while investigations continue, since the two vendors build their hardware very differently. Nobody has been publicly identified as responsible.
Separately, the Singapore Police Force issued an advisory on 28 October stating that Ledger wallets bought from certain retail stores in Singapore were found to contain malicious hardware components capable of capturing recovery phrases or private keys. At least two cases have been reported there since 10 September, and the investigation is ongoing.
Taken together, these reports point to a tampering operation somewhere in the retail supply chain in Southeast Asia, affecting more than one wallet vendor.
Why it matters
A hardware wallet's entire security model rests on the assumption that the device itself is trustworthy. An implant that sits between the processor and the screen bypasses the secure element, the firmware checks and the PIN entirely. It simply watches what the legitimate device shows the user. The recovery phrase appears on screen exactly once, during setup, and that single exposure is enough to drain every account derived from it, now or at any point in the future.
That is also why restoring the same phrase onto a clean device does not help. Once the phrase has left the room, the wallet it protects is compromised regardless of which hardware you use afterwards.
Trezor also stresses that owners cannot reliably check a device themselves. The Indonesian customer noticed a weight difference, but small variations have many innocent causes, and opening the case is neither safe nor conclusive. Expect scammers to seize on the news with fake "security check" emails, letters and phone calls asking for recovery phrases. Those are always fraudulent.
What to do
Trezor's guidance applies to every Trezor model bought from CryptoBilis since March 2026, through any channel that sold CryptoBilis-supplied stock, including its Tokopedia store:
- If the wallet is in use, create a brand-new wallet with a freshly generated recovery phrase and move the funds to it as soon as possible. Do not reuse the old phrase anywhere.
- If you have no other trusted hardware wallet, move the funds temporarily to a reputable software wallet or an exchange account you already use, rather than leaving them where they are.
- If the device is still unused, do not set it up, and never enter an existing recovery phrase into it.
- Keep the device and contact Trezor Support; the company is offering a replacement unit or a voucher covering its cost.
- If you are unsure where your wallet came from, check the seller name on your receipt or ask Trezor Support.
For organisations that hold cryptocurrency or custody keys on hardware, the broader lesson is about supply-chain assurance: purchase directly from the manufacturer or a verified channel, keep a record of where every device came from, and treat any unit with an uncertain origin as compromised until proven otherwise. The same discipline applies to the software and vendors around those devices. Our Bug Hunting engagements include supply-chain review, tracing where the components, dependencies and third parties in your environment come from and where an attacker could insert themselves, before a tampered link in the chain finds its way to you.