Trezor warns buyers of its devices through CryptoBilis since March after report of implant
Key Facts
Trezor warned customers who bought its devices through distributor CryptoBilis since March 2026 not to keep funds in their current wallets, urging them to move them as soon as possible to a new wallet with a new seed. The warning came after its security team received a report of an alleged hardware implant in a Trezor Safe 5 device bought by a customer from CryptoBilis. The company said the report concerned one device, but expanded its guidance to cover all Trezor models bought from the distributor. Trezor did not say that funds had been stolen from its device buyers, but said it had received no reports of losses from any buyer through CryptoBilis. The steps put the device’s source of purchase at the center of the warning, as customers are urged to take precautionary action before the examination is complete.
Trezor said the reported device was bought in August 2026 through the Tokopedia platform, and that its team received the report on October 28, 2026. It added that it had not received the device to verify the implant description, but treated the report as credible based on the customer’s account and a video interview. According to the report, an additional circuit board sits inside the device between the mainboard and the screen, alongside a cellular communications module and antenna. The description says the implant reads what appears on the screen, including the wallet’s recovery phrase, and then transmits it over the mobile network when the device is powered. The company said it is arranging to have the device sent to its laboratory, meaning details of the installation and how it works are still awaiting direct examination.
The company said CryptoBilis had been an authorized distributor in Southeast Asia, but it removed the firm from its distributor network on October 9, 2026. That action preceded the report concerning the Trezor device: the company said its team removed the distributor on that date, while it received the device report on October 28. The new warning comes amid the case involving Ledger devices also linked to hardware distributed by CryptoBilis. Ledger said at least one affected device contained an unauthorized hardware implant, and that the cases confirmed at the time were linked to devices sold by the distributor in Southeast Asia. Ledger said its internal systems and direct sales channels were unaffected by the confirmed cases.
According to CoinDesk, Tether froze $10 million in USDT linked to the theft of Ledger devices. Bloomberg had estimated losses at about $90 million on October 13, and said Ledger was reviewing its policies and device sales operations after the attack. These figures show that the loss estimates relate to the Ledger case and do not establish losses among Trezor buyers from CryptoBilis. Ledger also said it examined samples from its inventory and stores and found no compromised units among them.
Trezor offered buyers through CryptoBilis since March 2026 a new device shipped directly to them or a voucher covering the cost of a new device. The security step specified by the company remains moving funds to a new wallet with a new seed, rather than simply resetting the old wallet. In its response to the case involving its devices, Ledger said in an October 15 update that it had asked its authorized distributors to suspend sales in Southeast Asia and Hong Kong. It added that devices would not be displayed on shelves, but would remain in back stock and be handed over at purchase. Ledger said it was working with law enforcement and the security community to trace the funds and dismantle the attackers’ infrastructure, and that it would publish further details later.