Trezor Warns of Hardware Implant in Wallets Sold by CryptoBilis Reseller Since March 2026
Trezor issued an urgent warning after a customer discovered an unauthorized circuit board implanted in a Trezor Safe 5 wallet purchased from CryptoBilis, a former authorized reseller in Southeast Asia
Affiliate disclosure: We may earn a commission from qualifying purchases through these links at no additional cost to you. As an Amazon Associate I earn from qualifying purchases.
Trezor says it has issued an urgent warning after a customer found an unauthorized circuit board inside a Trezor Safe 5 wallet purchased from CryptoBilis, a former authorized reseller in Southeast Asia. According to The Hacker News, the suspected implant was discovered in Indonesia and appeared to sit between the wallet’s main board and its screen, with a cellular module and antenna that could capture and transmit the device’s recovery phrase over a mobile network when plugged in (The Hacker News, 2026-10-30).
What Trezor says happened
The reported issue centers on wallets sold by CryptoBilis, which Trezor says was a former authorized reseller. Trezor warned that anyone who bought a Trezor wallet from CryptoBilis since March 2026 should consider the device compromised (The Hacker News, 2026-10-30).
The company’s guidance is straightforward: if the wallet has already been used, move funds immediately to a new wallet with a new recovery phrase. Trezor also warned that restoring the old phrase to a new device would not be enough, because the phrase may already have been transmitted. If the device has not been used, Trezor says not to set it up at all (The Hacker News, 2026-10-30).
Why this matters
A hardware wallet is supposed to protect recovery material offline. If the reported implant did what Trezor fears, the threat is not just device tampering but potential theft of the recovery phrase itself, which could let an attacker access funds later. That makes the incident a supply-chain security concern rather than a normal device fault.
The Hacker News also reported that Trezor ended its relationship with CryptoBilis on October 9, after reports of similar malicious implants in Ledger wallets were being investigated. Separately, the outlet said the warning comes after a Singapore police advisory issued October 28 about similar malicious hardware components found in Ledger wallets bought from local retail stores (The Hacker News, 2026-10-30).
What is certain and what is not
What is clear from the available reporting is that Trezor says it received a report of a suspected implant and responded with a broad warning to customers who bought from CryptoBilis since March 2026. What remains uncertain, based on the source material alone, is the full scope of affected devices and how many units may have been altered.
Trezor’s advice, however, leaves little room for caution over convenience: do not trust the device if it has been used, and do not initialize it if it has not.
For readers managing crypto holdings, this is a reminder that hardware-wallet security depends not only on the device itself, but also on the integrity of the supply chain and the vendor relationship behind it.
Sources and dates
Research completed: 2026-10-31T05:07:00Z
Affiliate link: we may earn a commission at no additional cost to you. Check current features and terms before signing up.
Building your own website?
This separate resource is for readers creating an online business: Explore Systeme.io. It is an affiliate link, not an Amazon product recommendation.
This article may contain affiliate links. If you purchase through them, we may earn a commission at no additional cost to you.