Trezor Sounds Wallet Tamper Alert: CryptoBilis Buyers, Move Your Funds Before the Bad Board Says Cheese 🧀

Trezor urged customers who bought its hardware wallets from former authorized reseller CryptoBilis since March 2026 to move their funds after a customer reported finding a suspected implant inside a Trezor Safe 5 purchased through Tokopedia in August 2026. The company said the device could capture information displayed on the screen, including wallet recovery phrases, and transmit it over a cellular network.

The customer in Indonesia submitted the report through Trezor’s responsible disclosure program on October 28, 2026, according to the company. Trezor said the extra circuit board was fitted between the device’s main board and screen and included a cellular module and antenna. The company has not yet examined the device and said it had received no reports of related losses. “We haven’t had the device in our lab yet, but we’re treating the report as credible, and we’d rather warn people now than wait for confirmation and find out someone lost their funds in the meantime,” Trezor chief commercial officer Danny Sanders told Cointelegraph.

Trezor instructed CryptoBilis buyers to transfer funds to a newly created wallet with a new recovery phrase as soon as possible and not to reuse the old phrase on any device. Buyers who have not yet set up their device should not use it, while affected customers may keep their CryptoBilis device and contact Trezor Support for a replacement. A spokesperson said sales through the reseller were “very small” but declined to provide figures.

The warning came after reports of crypto losses involving Ledger wallets sold through CryptoBilis surfaced on Oct. 9, 2026. Ledger confirmed an unauthorized hardware implant in one affected device, and its Donjon security team found that the implant could read a 24-word recovery phrase from the screen during setup and send it over LTE. Trezor said the newly reported implant “appears to operate similarly,” although the company said it would not draw comparisons while investigations were ongoing and did not know who was behind it.

Trezor removed CryptoBilis as a reseller on October 9, 2026, and announced plans to reduce its reseller network on Oct. 13. The company said it had inspected four CryptoBilis-purchased devices—a Safe 7, two Safe 5s and a Safe 3—and found no evidence of tampering. Ledger has asked resellers in seven Asian markets to remove its devices, while one of the largest victims was a scammer who lost more than 60 BTC, worth about $4.8 million, according to blockchain analytics firm Chainalysis.