Hardware wallet maker Trezor says it received a report on 28 October of a hardware implant inside a Trezor Safe 5 that a customer in Indonesia bought in August from CryptoBilis through the Tokopedia marketplace. CryptoBilis was an official Trezor reseller in Southeast Asia until Trezor removed it on 9 October. Trezor has not yet received the device, so the report is unconfirmed, but after photos and a video interview it is treating it as credible and warning buyers now rather than waiting for lab results. No CryptoBilis buyer has reported losing funds to Trezor, and according to The Hacker News the customer had moved his funds off the wallet before finding the board.
According to The Hacker News, the customer described an extra circuit board between the wallet’s main board and its screen, with a cellular module and an antenna, that reads what the screen shows (including the recovery phrase) and sends it out whenever the device is plugged in. Trezor says the implant appears to work like the ones seen in Ledger devices sold through the same reseller, which we covered earlier (Ledger Confirms Spy Implant in Wallets Sold by CryptoBilis and Ledger Halts Asia Wallet Sales as Tampered Devices Spread). On 28 October the Singapore Police Force separately warned about tampered Ledger wallets bought from some Singapore retail stores, citing at least two cases and about $3.5 million in losses since 10 September.
How to check if you’re affected
Affected products are any Trezor model bought from CryptoBilis from March 2026 onward, according to Trezor. The Hacker News adds that this includes devices bought through any store that sold units CryptoBilis supplied, including its Tokopedia store. As of 30 October, Trezor had no reports involving any other reseller. If you are not sure where your device came from, check the seller’s name on your receipt or contact Trezor Support.
Trezor says owners cannot reliably check a device themselves and should not weigh or open it. The customer noticed a weight difference, but small differences can have other causes.
What Trezor advises for CryptoBilis buyers:
- If you already use the wallet, move your funds to a newly created wallet with a new recovery phrase as soon as possible. Restoring the old recovery phrase on another device does not help, because a tampered wallet could already have sent it out.
- If you have no other secure hardware wallet, move the funds for now to a software wallet or an exchange you know, and check the full receiving address before sending.
- If you have not set the wallet up, do not set it up and never type an existing recovery phrase into it.
- Keep the device and contact Trezor Support. Trezor says it will ship a new device or provide a voucher to cover one.
- Expect phishing. Trezor warns scammers will use the incident for fake emails, letters and phone calls, and says its support will never ask for your recovery phrase.