Trezor warns of suspected hardware implant in a wallet sold by reseller CryptoBilis

Hardware wallet maker Trezor has warned customers about a suspected malicious implant found inside one of its devices sold through a former reseller, CryptoBilis. According to The Hacker News, a customer in Indonesia reported the tampering around October 28, 2026, after discovering an unexpected circuit board inside a Trezor Safe 5 he had bought through the reseller's Tokopedia store in August.

What happened

The customer found an extra circuit board wedged between the wallet's main board and its screen, fitted with a cellular module and antenna, The Hacker News reports. Per Trezor's warning, the implant reads what appears on the screen, including the recovery phrase (what Trezor calls the wallet backup), and transmits it whenever the device is plugged in. The customer said he had already moved his funds off the device before finding the board. Trezor says it has the customer's photos, a description and a video interview, and is arranging to get the wallet to its lab for analysis.

Who is affected

Trezor's advice covers every Trezor model bought from CryptoBilis since March 2026, including any store that sold CryptoBilis-supplied devices, such as its Tokopedia listings, according to the report. Trezor was CryptoBilis's authorized reseller in Southeast Asia but dropped it on October 9, after Ledger began investigating losses among its own customers who had bought from the same reseller. The Hacker News notes Trezor has not stated how many units may be affected and, as of October 30, had no reports involving any other reseller. No CryptoBilis buyer has reported losing funds to Trezor, which cannot see what customers hold.

What to do

Trezor recommends that affected buyers move their funds to a new wallet with a new recovery phrase as soon as possible, The Hacker News reports. Critically, restoring the old recovery phrase onto another device does not help, since a tampered device may already have transmitted it. Trezor advises against setting up a device under suspicion, and against ever entering an existing recovery phrase into it. Those without another secure hardware wallet are told to use a trusted software wallet or exchange in the meantime. Trezor says it will ship a replacement or provide a voucher, and warns that the device should not be weighed or opened to test it. Buyers should also expect phishing attempts, through fake emails, letters and calls, tied to the incident.

A broader pattern

Trezor says the board appears to work like implants Ledger found in its own devices, though it will not compare the two while investigations continue, per the report. Separately, The Hacker News notes the Singapore Police Force issued an advisory on October 28 about Ledger wallets bought from some retail stores containing malicious components, with at least two cases reported since September 10 — a reminder that supply-chain tampering of hardware wallets is a recurring risk. Trezor and Ledger have long urged buyers to purchase only from official channels.