Trezor Warns CryptoBilis Buyers to Move Funds Over Suspected Implant

Anyone who bought a Trezor hardware wallet through the former reseller CryptoBilis since March 2026 is being told to move their funds to a new wallet. The warning follows a customer's report of what looks like a cellular implant inside a Safe 5 device. Trezor has not yet examined the hardware itself.

According to Trezor's October 30 announcement, it received the security disclosure on October 28. A customer in Indonesia bought the wallet through CryptoBilis on Tokopedia in August 2026 and reported an additional circuit board inside the casing.

The suspected component reportedly sits between the main board and the screen. It is said to include a cellular module and antenna, which could in principle capture the recovery phrase as it appears on the display and transmit it over a mobile network whenever the device is powered. A recovery phrase is the string of words that regenerates a wallet's private keys, so whoever holds it controls the funds regardless of the device's secure chip.

Trezor has worked from photographs and a video-call interview with the customer, and says it considers the report credible. Its security team is arranging to receive the wallet for lab examination. The reporting customer had already moved his crypto out of the device before he found the extra hardware, and Trezor says no losses have been reported to it. SEAL 911 is advising the company on its response.

What affected buyers are told to do

Trezor's guidance is blunt. Customers who bought any model from CryptoBilis since March 2026, including through Tokopedia and other stores it supplied, should create a new wallet with a fresh recovery phrase. Importing the old phrase into another wallet does not remove the risk, because the phrase itself may already be exposed. Unconfigured devices should not be set up.

Trezor also advises against trying to spot tampering by opening the device or weighing it, saying weight differences cannot reliably show modification. Eligible buyers can receive a replacement shipped by Trezor or a voucher, and should keep their existing hardware and contact support. The company warned of scam emails, letters and calls exploiting the situation, and reminded customers never to share their recovery phrases.

How this fits the earlier warnings

Trezor removed CryptoBilis as an authorized reseller on October 9, after Ledger confirmed that some wallets sold through the same channel had been tampered with, a step we covered when Trezor cut its reseller network over supply chain concerns. Ledger later said an unauthorized component could capture recovery phrases during setup and send them over LTE, operating separately from the security chip.

The evidence on Trezor's side is thinner. By October 19 it had inspected four CryptoBilis wallets, two Safe 5 units, a Safe 7 and a Safe 3, and found no physical tampering. The newly reported Safe 5 was not among them. Investigators have not identified who installed the implant, or whether the same attackers were behind the Ledger incident.

The Ledger case shows what is at stake. On October 29, Arkham Intelligence traced $95.35 million in suspected thefts involving 1,486 addresses between October 7 and 9, with about $10 million in USDT frozen. Singapore police separately reported S$3.5 million in losses across two cases involving tampered Ledger devices.

The implant remains unconfirmed until the lab examination. But the precaution Trezor is asking for is cheap relative to the downside, and it underlines a structural point: a hardware wallet's security model assumes the device left the factory untouched, and a compromised reseller channel breaks that assumption before the buyer ever plugs it in.