TLDR
- Trezor has urged CryptoBilis customers who purchased hardware wallets since March 2026 to transfer their cryptocurrency.
- An Indonesian customer reported a suspected hardware implant inside a Trezor Safe 5 bought through Tokopedia.
- The alleged implant could capture wallet recovery phrases and send them through a cellular network.
- Trezor has not physically examined the reported device and has received no reports of related cryptocurrency losses.
- The company removed CryptoBilis from its authorized reseller network on October 9 following confirmed Ledger wallet tampering.
Trezor has told customers who purchased hardware wallets from former reseller CryptoBilis since March 2026 to move their cryptocurrency after a buyer reported a suspected implant inside a Safe 5 device.
The company issued its warning on October 30, before inspecting the device. Trezor said it had received no reports of stolen funds linked to the case. The alert covers every Trezor model purchased through CryptoBilis, not only the Safe 5.
Trezor Receives Report From Indonesian Buyer
An Indonesian customer alerted Trezor on October 28 about a Safe 5 purchased through Tokopedia in August. CryptoBilis was still an authorized seller when the buyer placed the order.
Trezor reviewed photographs and interviewed the customer but has not tested the device. Chief commercial officer Danny Sanders said, “We haven’t had the device in our lab yet,” adding that the company considered the account credible. The company declined to disclose exact reseller sales figures.
Suspected Circuit Could Capture Recovery Phrases
The report describes an extra board between the wallet’s main circuit and screen. A cellular module and antenna could allegedly transmit screen contents, including recovery words, whenever the device receives power.
The concern follows reports of tampered Ledger wallets in Singapore. Police reported two cases involving losses totaling about S$3.5 million. Trezor has not connected those cases to its reported device.
A recovery phrase allows someone to restore a cryptocurrency wallet without the original hardware. Trezor said attackers could exploit those words even if a customer later switched devices.
Earlier Cases Prompt Reseller Review
Trezor removed CryptoBilis from its approved seller list on October 9, after Ledger confirmed physical changes to devices sold through the same reseller. Investigators have not identified who altered the reported Trezor unit.
Trezor inspected four other wallets obtained through CryptoBilis and found no tampering. Separately, Keystone reported a breach of customer shipping information this week, although that case did not involve exposed wallet recovery phrases.
Customers Told to Replace Wallet Backups
Trezor advised affected buyers to create fresh wallets with new recovery phrases and transfer their holdings. Restoring an old recovery phrase on different hardware would leave any earlier exposure unresolved.
The company also warned against false security messages. Recently, Foundation Passport customers received phishing emails that included personal purchase details. The separate incident involved misleading emails rather than confirmed changes to wallet hardware.
Customers who have not activated their devices should leave them unused. Trezor offers eligible buyers replacement wallets or vouchers through its support team and says support staff never request recovery phrases.
