Trezor warns of suspected implant in CryptoBilis wallet
Original title: Trezor Warns of Suspected Spy Implant in Crypto Wallet That Could Steal Recovery Phrases
One Indonesian Safe 5 buyer reported an extra board; Trezor has not lab-tested it and knows of no stolen funds.
Trezor warned on October 30 that a suspected hardware implant in a Trezor Safe 5 bought from CryptoBilis could read recovery phrases from the screen and send them over a mobile network. The precautionary scope covers every Trezor model bought from CryptoBilis from March 2026 onward, including stores supplied by that reseller. Trezor has not examined the device. It told affected users to create a new wallet with a new seed and move funds, and not to enter an existing phrase on an unused device.
Unconfirmed: Trezor has not examined the device, has no reports of stolen funds from CryptoBilis buyers, and has not identified the attackers.
- The customer bought the Safe 5 on Tokopedia in August 2026; Trezor was told on October 28.
- An extra board with a cellular module and antenna allegedly sits between the main board and screen.
- Trezor removed CryptoBilis from its authorized reseller network on October 9.
- Ledger has confirmed physical tampering in some CryptoBilis-supplied Ledger devices after fund-loss reports.
- Eligible buyers can request a replacement or voucher and should keep the original wallet.
Impact: Suspected theft of wallet recovery phrases over a mobile network
| Product | Affected |
|---|---|
| Trezor wallets sold by CryptoBilis | Purchases from March 2026 onward; reported device is a Safe 5 |
- 1.Move funds to a newly generated wallet; do not reuse the existing seed.
- 2.Leave an unused affected device unused and do not enter an existing recovery phrase.
- 3.Contact official Trezor Support; support will never ask for a recovery phrase.
- Products
- Trezor Safe 5
- Organizations
- CryptoBilisSEAL 911Tokopedia
- Countries
- Indonesia
From the original article
3 min read at cybersecuritynews.com
Trezor has warned that a suspected hardware implant inside a Trezor Safe 5 could steal recovery phrases and send them over a mobile network. The warning covers every Trezor model bought from CryptoBilis from March 2026 onward, although only one suspected device has been reported. In its October 30 security notice, Trezor urged affected users […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.