Implant reported in a Trezor sold by CryptoBilis

Summary

The Trezor security team has received a responsible disclosure report alleging a hardware implant in a Trezor Safe 5 purchased from CryptoBilis, which until October 2026 was an official Trezor reseller in Southeast Asia.

We haven’t received the device to confirm this, but based on the customer’s description, it’s being treated as a credible report, and we are sharing it now so customers who purchased a Trezor via CryptoBilis can secure their funds as a precaution.

Our security team will examine the device as soon as it arrives.

No CryptoBilis buyer has reported a loss of funds to us. We will update this notice if that changes.

The CryptoBilis incident

On October 9, 2026, Ledger began investigating fund losses among customers who had bought hardware wallets from CryptoBilis, its authorized reseller in Southeast Asia. Ledger later confirmed that some of these devices had been physically tampered with in a sophisticated supply chain attack.

CryptoBilis was also an authorized Trezor reseller at the time, so our team promptly removed them on October 9, 2026, and has been investigating customer devices since then.

We took further precautions to secure our supply chain by limiting the authorized sellers going forward:

This was a preventive step, taken out of an abundance of caution. We have now discovered evidence that a single Trezor device may have been affected by a similar attack.

A new update affecting Trezor customers who purchased from CryptoBilis

On October 28, 2026, our security team received a responsible disclosure of a single hardware implant in a Trezor Safe 5 device bought from the reseller CryptoBilis in August 2026. It was purchased via Tokopedia. This implant appears to operate similarly to those seen in Ledger devices.

We haven’t received the device to confirm this report, but based on the customer’s description and a video interview, we’re treating it as credible and sharing it now so customers who purchased a Trezor via CryptoBilis can secure their funds as a precaution. Our security team will examine the device as soon as it arrives.

No funds have been reported as stolen.

If you bought a Trezor from CryptoBilis from March 2026 onwards, we know this is unsettling. Here’s what to do:

Already using it?

• Move your funds to a new wallet with a new seed as soon as possible. Using the wallet backup generated by the tampered wallet on another device does not solve the issue.
• Consider moving your funds to an exchange or software wallet if no other secure hardware wallet is available.

Not set up yet?

• Don’t set it up, and never enter your existing wallet backup on it.

Any customer who purchased from CryptoBilis from March 2026 onwards is eligible to receive a new Trezor device, which we will ship directly, or provide a voucher to cover the cost of a new device. Please keep your CryptoBilis device and contact Support to arrange this.

We would like to thank the customer who reported this through our responsible disclosure program. Reports like this help us protect everyone else and improve the industry security standards.

We’d also like to thank SEAL 911, the Security Alliance’s emergency response service for crypto security incidents, for working alongside our teams on this report and advising on how we support affected customers.

Timeline

Your questions, answered (FAQs)

What exactly was found?

The report describes an extra circuit board fitted inside a Trezor Safe 5, between the main board and the screen, with a cellular module and an antenna. According to the report (we have not verified this ourselves), it reads what the screen shows, including the wallet backup, and sends it out over a mobile network whenever the device is plugged in.

A Trezor customer in Indonesia reported it to our security team through responsible disclosure.

Have you examined the device yourselves?

Not yet. We’ve received the report and photos, interviewed the reporter via video call, and are now arranging to have it sent to our lab. What we’ve seen looks sophisticated enough that we decided to warn customers now. Waiting for lab confirmation would leave CryptoBilis buyers exposed in the meantime.

Is this the same as the Ledger implant? Same attackers?

Every hardware wallet maker builds its devices differently, so we won’t draw comparisons while investigations are ongoing. We don’t know who is behind this. Our security team will examine the device as soon as it arrives. We are working with Ledger and other parties investigating the issue to ensure everyone has complete information.

Has anyone lost funds?

We have no evidence that any customer has lost funds. The customer who reported the implant had already moved his funds off the device before he found it. Trezor wallets are self-custodial, so we can’t see anyone’s balance. If you bought from CryptoBilis and notice anything wrong, contact Trezor Support.

The report concerns a Trezor Safe 5. Our guidance applies to every Trezor model bought from CryptoBilis.

Which marketplaces are included?

Any store selling devices supplied by CryptoBilis, including its store on Tokopedia. If you’re not sure where your device came from, check the seller name on your receipt or contact Support.

Are other resellers or regions affected?

We have no reports involving any other reseller. If that changes, we’ll update our customers.

Can I check my own device? Should I weigh it or open it?

No. Weighing isn’t a reliable test, and there’s no dependable way to inspect a device yourself. The person who reported this noticed a weight difference, but small differences can have other causes, so a scale can’t confirm or rule out tampering. If you bought from CryptoBilis since March 2026, move your funds now as a precaution and contact Trezor Support.