Trezor warns of possible crypto wallet implant linked to CryptoBilis

Traders Union
All News
Crypto
Trezor warns CryptoBilis buyers of tampering

Highlights

Trezor warns CryptoBilis buyers of tampering.
Suspected implant could expose wallet seeds.
No fund losses confirmed; replacements offered.

In an October 30 security notice, Trezor said an Indonesian customer reported finding an additional circuit board inside a Trezor Safe 5 purchased through Tokopedia in August. The company received the disclosure on October 28 and decided to alert customers before completing a physical examination of the device.

Suspected implant could expose wallet recovery phrases

According to the report, the unauthorized circuit board was positioned between the device's main board and display. It allegedly contained a cellular communication module and antenna capable of capturing information shown on the screen and transmitting it over a mobile network.

That information could include a wallet's recovery phrase, which provides access to cryptocurrency holdings. If compromised, the phrase could allow an attacker to recover the wallet elsewhere without possessing the original hardware device.

Trezor has reviewed photographs and interviewed the customer but has not yet received the device for laboratory testing. The company said the available evidence warranted immediate precautions while emphasizing that the implant's reported capabilities remain unverified.

The customer had already transferred funds before discovering the suspected modification. Trezor has received no reports of stolen cryptocurrency linked to the incident.

CryptoBilis investigation follows Ledger attacks

The warning follows a separate supply chain investigation involving Ledger devices distributed through CryptoBilis, a former authorized reseller in Southeast Asia. Ledger began examining customer losses on October 9 and subsequently confirmed physical tampering involving some devices.

Trezor removed CryptoBilis from its authorized reseller network that day and began investigating potentially affected products. The company has not established whether the suspected Trezor modification and confirmed Ledger incidents involved the same attackers.

No reports currently implicate other Trezor resellers, although the precautionary guidance applies to every Trezor model purchased through CryptoBilis since March.

Customers advised to replace devices and recovery phrases

Trezor recommends transferring cryptocurrency to a newly created wallet with a completely new recovery phrase. Restoring the existing phrase on another device would not eliminate the risk if that information had already been exposed.

Customers without another secure hardware wallet can temporarily use a trusted software wallet or exchange. Those who have not activated their CryptoBilis devices should avoid setting them up or entering existing recovery phrases.

Eligible buyers can request a replacement device or voucher through Trezor Support. The company also cautioned against phishing attempts exploiting the warning.

Earlier, we reported that Trezor's security chief said tricking users is easier than hacking crypto wallets.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.