Key Takeaways
- Trezor reported a suspected malicious hardware implant in a Safe 5 wallet purchased from former authorized reseller CryptoBilis, potentially exposing users’ recovery phrases.
- The discovery follows a $93 million Ledger wallet security scandal involving compromised devices distributed through CryptoBilis, prompting Trezor to significantly reduce its reseller network.
- Trezor urged customers who purchased devices from CryptoBilis since March 2026 to move their funds to new wallets with fresh recovery phrases, while its investigation continues.
In a Friday announcement, Trezor said its security team received a credible report of a malicious hardware implant inside a Trezor Safe 5 purchased from CryptoBilis, a former authorized reseller in Southeast Asia that was also implicated in the Ledger incident.
The affected device was purchased in August through Indonesian e-commerce platform Tokopedia, with the customer reporting the discovery to Trezor on Oct. 28.
According to Trezor, the implant consists of an additional circuit board installed between the wallet’s main board and screen, equipped with a cellular module and antenna. The device allegedly captures information displayed on the screen, including the wallet’s recovery phrase, and transmits it over a mobile network when connected to power.
Trezor said it has reviewed photographs and interviewed the customer but has not yet physically examined the device. The company is treating the report as credible while awaiting laboratory verification.
No funds have been reported stolen from Trezor customers in connection with the suspected compromise, the company said.
Trezor Discovery Follows Ledger Saga
The discovery follows a major security incident involving rival hardware wallet manufacturer Ledger, which began investigating customer losses on Oct. 9 after reports emerged that devices distributed through CryptoBilis had been physically modified.
Ledger subsequently confirmed that some devices had been compromised in a sophisticated supply chain attack, with reported user cryptocurrency losses estimated at $93 million.
As Bitcoin.com News previously reported, Trezor responded to the Ledger scandal by announcing plans to dramatically reduce its authorized reseller network beginning Jan. 1, 2027, seeking greater control over the distribution of its devices.
At the time, Trezor maintained that it had no evidence of compromised devices bearing its own brand. However, the company had already revoked CryptoBilis’ authorization on Oct. 9 and begun investigating potentially affected products.
Ledger attributed the broader operation to a highly organized criminal group that reportedly spent millions of dollars orchestrating the attack. The manufacturer also said it had inspected samples from its own inventory without identifying compromised units.
Trezor has not established whether the suspected attack on its device was carried out by the same perpetrators responsible for the Ledger compromises.
The company is urging anyone who purchased a Trezor device from CryptoBilis since March 2026 to immediately transfer their cryptocurrency to a new wallet with a newly generated recovery phrase. Simply restoring the potentially compromised wallet’s existing recovery phrase on another device would not eliminate the risk.
Customers who have not yet initialized their devices are being advised against using them. Trezor said affected buyers are eligible for a replacement device shipped directly by the company or a voucher covering the cost of a new wallet.
The company emphasized that its warning applies to all Trezor models purchased through CryptoBilis, although the suspected implant has only been reported in a single Safe 5 device.
Trezor said it has received no similar reports involving other resellers and is coordinating with Ledger and security researchers as the investigation continues.
