Trezor Warns of Suspected Recovery-Phrase Implant in CryptoBilis-Sold Wallets
Summary
After a customer reported a suspected recovery-phrase-stealing implant in a CryptoBilis-sold Trezor Safe 5, Trezor advised buyers of CryptoBilis-supplied devices since March 2026 to move funds to a new wallet.
Key points
- A customer reported an extra circuit board in a Trezor Safe 5 bought from CryptoBilis; Trezor has not yet examined the device.
- According to the report, the board reads the wallet screen, including the recovery phrase, and sends it over a mobile network.
- Trezor advised buyers of CryptoBilis-supplied Trezor devices purchased since March 2026 to move funds to a new wallet with a new recovery phrase.
- Trezor said the customer had moved his funds before finding the board and that it had received no reports of CryptoBilis buyers losing funds.
- Trezor advised owners not to open or weigh devices to check for an implant and warned of possible follow-on phishing.
- Trezor said it does not know who is responsible and is arranging to examine the reported device.
- Ledger and Singapore police have separately reported malicious hardware components in some Ledger wallets linked to CryptoBilis; investigations are ongoing.
Article Details
- Victim Organization
- Customers who bought Trezor devices supplied by CryptoBilis
- Incident Type
- Suspected hardware implant in a Trezor Safe 5 that allegedly reads and transmits the wallet recovery phrase over a mobile network
- Disclosure Date
- 2026-10-30
- Data Types Exposed
- Wallet recovery phrase (allegedly captured and transmitted)
- Affected Records
- Unknown
- Affected Data Size
- Unknown
- Operational Impact
- Potential exposure of wallet recovery phrases. Trezor reported no customer reports of lost funds among CryptoBilis buyers; the reporting customer moved his funds before discovering the board.
- Ransom Or Extortion
- Unknown
- Claim Status
- alleged
Vendors
CryptoBilisA Trezor Safe 5 hardware wallet bought from the reseller CryptoBilis has an extra circuit board that sends out the recovery phrase over a mobile network, a customer has reported.LedgerTrezor dropped CryptoBilis, its authorized reseller in Southeast Asia, on October 9, after hardware wallet maker Ledger began investigating losses among Ledger customers who had bought from CryptoBilis.TrezorA Trezor Safe 5 hardware wallet bought from the reseller CryptoBilis has an extra circuit board that sends out the recovery phrase over a mobile network, a customer has reported.
Products
Countries
IndonesiaTrezor said in a blog post on October 30 that the report came in two days earlier from a customer in Indonesia. He bought the wallet from CryptoBilis in August, through the marketplace Tokopedia.SingaporeThe Singapore Police Force said in an advisory on October 28 that Ledger hardware wallets bought from some retail stores in Singapore contained malicious hardware components. At least two cases have been reported since