Trezor told everyone who bought one of its wallets from the reseller CryptoBilis since March 2026 to move their funds to a new wallet with a new seed, in a notice published on Friday 30 October. The alert rests on one report: a customer in Indonesia says he found a hardware implant inside a Trezor Safe 5, and Trezor has not yet seen the device. No CryptoBilis buyer has reported a loss to the company, and its inspection of four other CryptoBilis units found no tampering.
Trezor chose not to wait for its lab. “What we’ve seen looks sophisticated enough that we decided to warn customers now,” it wrote, adding: “Waiting for lab confirmation would leave CryptoBilis buyers exposed in the meantime.”
CryptoBilis is the Southeast Asian reseller at the centre of the tampered Ledger case, where Ledger confirmed an implant on 10 October. When we last updated that story, no tampered Trezor had been reported. CryptoBilis has not commented in the sources we found.
What the customer says he found inside his Trezor Safe 5
The report reached Trezor’s security team on Wednesday 28 October through its responsible disclosure programme. The device is a Safe 5 bought from CryptoBilis in August 2026 through Tokopedia, the Indonesian marketplace. The customer has not been named.
According to the report, an extra circuit board with a cellular module and an antenna sits between the main board and the screen. It reads what the screen shows, including the wallet backup, and sends that out over a mobile network whenever the device is plugged in. Trezor says plainly that it has not verified this.
Trezor’s security, hardware and reseller teams went through the report, photos and receipt the same day, then interviewed the customer by video. The company calls the report credible and is arranging for the device to reach its lab. The customer noticed a difference in weight, it says, and had already moved his funds off the wallet before he found the board.
Reported in Trezor, confirmed in Ledger: where each case stands
Trezor writes that the implant “appears to operate similarly” to those seen in Ledger devices. It also says it will not draw comparisons while the investigations run, because each maker builds its hardware differently. The two cases are at very different stages.
| Ledger | Trezor | |
|---|---|---|
| Status | Implant confirmed by Ledger on 10 October | Single customer report, not confirmed |
| Device examined by the maker | Yes, Ledger’s Donjon team published findings on 13 October | No, a lab exam is pending |
| Reported mechanism | Reads the 24 words at setup, sends them over LTE through an eSIM | Reads the screen, sends over a mobile network when plugged in (unverified) |
| Losses | Funds drained on 9 October, estimates from $86M to about $103M, no total from Ledger | None reported to Trezor |
| Maker’s response | Sales suspended in Southeast Asia and Hong Kong, reseller rules tightened on 15 October | New seed for CryptoBilis buyers, replacement device or voucher |
Who the Trezor warning covers, and who it does not
The notice applies to every Trezor model bought from CryptoBilis from March 2026 onwards, even though the report concerns a single Safe 5. It includes any store supplied by CryptoBilis, as well as the reseller’s own Tokopedia shop. Trezor does not explain why it chose March. OneKey, another maker that dropped CryptoBilis, picked the same month: its statement, updated on 12 October, offers replacements for devices bought from the reseller since 1 March.
Trezor says it has no reports involving any other reseller. A device bought from the official shop or from another authorised retailer falls outside this warning. Buyers who are unsure where theirs came from can check the seller’s name on the receipt or ask Trezor Support.
What Trezor tells CryptoBilis buyers to do
- If the wallet holds funds, create a new wallet with a new seed and send the funds there. Trezor’s words: “move your funds to a newly created wallet with a new seed as soon as possible”.
- Do not restore the old backup on another device. If the seed was copied, the problem follows it.
- If you have no other secure hardware wallet, Trezor suggests moving funds for now to a software wallet or an exchange you already know.
- Check the full receiving address before sending anything.
- If the device is still unused, do not set it up, and never enter an existing backup on it.
- Keep the CryptoBilis device and contact Trezor Support. Buyers from March 2026 onwards are eligible for a new device shipped by Trezor or a voucher covering the cost.
Trezor also expects scammers to exploit the news with fake emails, physical letters and phone calls. Its support staff never ask for a recovery phrase. Buyers have reason to take the letters seriously. In August, The Block reported, Trezor said a breach at shipping provider ShipMonk had exposed data on about 13,700 customers in seven countries, among them the US, the UK and Italy, with shipping addresses for most. In September it added about 67,000 US customers. Trezor’s notice does not connect that breach to CryptoBilis.
Why the fix is a new seed and a scale proves nothing
A hardware wallet keeps its keys inside a chip, and the Safe 5 has a secure element certified to EAL 6+, as our Trezor Safe 5 review covers. That chip protects what is stored inside it. It cannot stop a separate board from reading the screen at the moment the words appear for the owner to write down. In the Ledger case, Donjon found the implant left the Secure Element, the operating system, transactions and signatures untouched. The attack went around the chip.
Anyone holding a copied seed can rebuild the wallet on their own hardware, which is why changing devices and keeping the seed solves nothing. Our guide to seed phrase security explains how to store a new one, and the steps for a clean start are in how to set up a hardware wallet. Trezor has its own guide to sending funds in Trezor Suite.
Owners have no home test either. Trezor advises against weighing or opening a device: small weight differences can have other causes, so a scale can neither confirm nor rule out tampering, and it says there is no dependable way for owners to inspect a wallet themselves.
Four CryptoBilis units came back clean, out of an unknown number sold
Trezor’s dates come from a timeline in its notice. On 9 October, the day Ledger opened its investigation, Trezor asked CryptoBilis to stop selling all its devices, and it says the reseller complied. It removed CryptoBilis from its authorised network the same day and began limiting its authorised sellers on 13 October. On 14 October it asked CryptoBilis buyers to send devices in for inspection.
Four came back from 19 October: a Safe 7 ordered on 6 April, two Safe 5 units ordered on 7 June and a Safe 3 ordered on 4 August. Trezor found no evidence of tampering in any of them. The Safe 5 reported on 28 October was not in that batch, Cryptonomist notes, and the dates fit: the two inspected Safe 5 units were ordered in June, the reported one was bought in August. Trezor has not said how many devices CryptoBilis sold, so nobody outside the company can tell what share of them four units represents.
Ledger’s case is the only one with confirmed losses
Ledger’s investigation began on 9 October, and on 13 October its Donjon team published the mechanism. In its 15 October response, Ledger said the attackers had bought genuine devices over many months, opened them and fitted hidden components. It has published no loss total. The researchers’ figures collected in our Ledger file run from more than $86 million (Specter, 9 October) to $102 million across 324 wallets (Bitquery’s update, via Journal du Coin) and more than $103.4 million from 530 addresses (YFarmX, via Cointelegraph). Cryptoast adds an Arkham count of $95.35 million across 1,486 addresses between 7 and 9 October. None is verified.
Chainalysis identified a scam operator among the largest victims, with 60.3 BTC lost, worth about $4.8 million when the firm reported it on 15 October. On 28 October the Singapore police counted at least two cases since 10 September and about S$3.5 million lost on tampered Ledgers bought from retail stores in the city-state, which it did not name.
Nothing yet ties the Trezor report to the same attackers. Trezor says it does not know who is behind it, and Cryptoast notes that no evidence links the two cases. None of the sources we read accuses CryptoBilis of taking part, and Trezor says the reseller complied when asked to stop sales. Trezor has not said where in the chain the reported Safe 5 would have been opened.
Trezor’s lab exam comes next, with no date set
Trezor says only that it will examine the device as soon as it arrives. A confirmed board would make it the second brand with an implant traced to this reseller. A clean result would clear one unit and leave the advice to CryptoBilis buyers as a precaution they have already taken.
The company says it will update its notice if a CryptoBilis buyer reports a loss or if another reseller is involved. It is working with Ledger and other parties, and thanks SEAL 911, the Security Alliance’s emergency service, for helping on this report. Separately, the resellers it notified under its 13 October cuts lose their authorisation on 1 January 2027, according to Decrypt.