Trezor warns of suspected hardware implant in CryptoBilis wallets

What happened

Trezor announced on October 30 that it had received a report of a suspected hardware implant inside a Trezor Safe 5 device purchased through CryptoBilis, a former authorized reseller, in August 2026. The device was bought by a customer in Indonesia through Tokopedia and reportedly contains an unauthorized circuit board positioned between the wallet's main board and screen. The customer discovered the additional hardware and reported it to Trezor's security team.

According to the report, the suspected implant includes a cellular module and antenna designed to capture information displayed on the device's screen, including wallet recovery phrases, and transmit that data over a mobile network. The customer who discovered the device had already moved their cryptocurrency holdings before identifying the unauthorized hardware. Trezor said it had reviewed photographs and conducted a video interview with the customer but has not yet physically examined the wallet in its laboratory.

In response, Trezor urged all customers who purchased its hardware wallets from CryptoBilis since March 2026 to transfer their funds to a newly created wallet with a fresh recovery phrase. The company emphasized that importing an existing recovery phrase into another wallet would not eliminate the risk if that phrase had already been exposed. Trezor also offered affected customers either a replacement device shipped directly or a voucher to purchase a new wallet, and warned against attempting to identify tampering by opening or weighing devices.

Trezor Chief Commercial Officer Danny Sanders told Cointelegraph that the company decided to issue the warning immediately despite not having examined the device. "We haven't had the device in our lab yet, but we're treating the report as credible, and we'd rather warn people now than wait for confirmation and find out someone lost their funds in the meantime," he said. No customer losses have been reported to Trezor related to this incident.

Why it matters

A compromised recovery phrase represents a critical vulnerability in hardware wallet security. The recovery phrase is the master key that can restore access to a wallet on any device, meaning an attacker who obtains it can transfer funds without needing the original hardware. Unlike vulnerabilities that affect the device's firmware or operating system, a physical implant that silently captures and exfiltrates this information represents a sophisticated attack that bypasses many standard security measures. The incident underscores how hardware wallets remain only as secure as their supply chain and the integrity of the physical devices themselves.

The warning also highlights broader concerns about cryptocurrency custody through third-party resellers. Both Trezor and Ledger, the two largest hardware wallet manufacturers, have now confirmed or are investigating tampered devices sold through the same reseller. This pattern suggests coordinated targeting of a specific distribution channel rather than isolated incidents. For users who purchased hardware wallets, the event reinforces that devices from unauthorized sellers or unfamiliar channels carry elevated risk, despite hardware wallets generally being considered more secure than software alternatives.

Background

CryptoBilis was an authorized reseller for both Trezor and Ledger in Southeast Asia until October 9, 2026, when it was removed from both companies' reseller networks. The removal followed reports that Ledger devices sold through CryptoBilis had been physically tampered with. Ledger confirmed that one affected device contained an unauthorized hardware implant. On October 29, blockchain analytics firm Arkham Intelligence traced approximately $95.35 million in suspected thefts involving 1,486 addresses between October 7 and 9, a period overlapping with the initial reports of compromised devices.

The CryptoBilis incident is not the first time security researchers have identified compromised hardware wallets in circulation. Earlier in 2026, security researcher Joe Grand reported finding tampered Trezor One and Model T wallets purchased through unauthorized sellers on TikTok and Facebook. These discoveries have prompted hardware wallet manufacturers to enhance their scrutiny of reseller networks and implement additional authentication measures, though both Trezor and Ledger acknowledged that existing physical protections like seals and packaging are insufficient on their own.

What to watch

Trezor's investigation into the suspected implant is ongoing. The company's security team is arranging to receive the wallet for laboratory examination to determine technical details about the implant's construction and capabilities. Investigators have not yet identified who installed the suspected implant or whether the same attackers were responsible for the earlier Ledger incidents. As of mid-October, Trezor had received four wallets purchased through CryptoBilis for inspection, and none showed signs of physical tampering, though the newly reported device was not among those examined.

Both Trezor and Ledger have announced plans to restrict their reseller networks in response to the incidents. Trezor announced on October 13 that it would reduce its authorized reseller network. The investigation is being conducted with assistance from SEAL 911, the Security Alliance's emergency response service. As the examination of the suspected implant progresses, additional details about the attack vector and scope may emerge, and both manufacturers are likely to implement new security and verification procedures for their distribution channels.

Questions readers ask