Trezor Warns of Suspected Hardware Implant in One of Its Wallets Sold by CryptoBilis Ravie LakshmananOct 30, 2026Hardware Security / Cryptocurrency A Trezor Safe 5 hardware wallet bought from the reseller CryptoBilis has an extra circuit board that sends out the recovery phrase over a mobile network, a customer has reported. Trezor has not yet examined the device. It is telling everyone who bought a Trezor from CryptoBilis since March 2026 to move their funds to a new wallet with a new recovery phrase. Trezor said in a blog post on October 30 that the report came in two days earlier from a customer in Indonesia. He bought the wallet from CryptoBilis in August, through the marketplace Tokopedia. The board sits between the wallet's main board and its screen, with a cellular module and an antenna, according to the report. It reads the screen, including the recovery phrase (Trezor calls it the wallet backup), and sends it out whenever the device is plugged in. Trezor has the customer's photos and description and has interviewed him on a video call. It is arranging for the wallet to be sent to its lab. Trezor finds the report believable enough to warn buyers now. "Waiting for lab confirmation would leave CryptoBilis buyers exposed in the meantime," the company said. No CryptoBilis buyer has reported losing funds to Trezor, which cannot see what customers hold in their wallets. The customer had moved his funds off the wallet before he found the board. Trezor's advice covers every Trezor model bought from CryptoBilis since March 2026, from any store that sold devices CryptoBilis supplied, including its store on Tokopedia: If you already use the wallet, move your funds to a new wallet with a new recovery phrase as soon as possible. Restoring the old recovery phrase on another device does not help, because a tampered wallet could already have sent that phrase out. If you have no other secure hardware wallet, move the funds for now to a software wallet or an exchange you know. If you have not set up the wallet, do not set it up, and never type your existing recovery phrase into it. Keep the CryptoBilis device and contact Trezor Support. Trezor will ship you a new device or give you a voucher that covers the cost of one. If you are not sure where your device came from, check the seller's name on your receipt or contact Trezor Support. As of October 30, Trezor had no reports involving any other reseller. Owners cannot reliably check a device themselves and should not weigh or open it to try it, according to Trezor. The customer noticed a weight difference, but small differences can have other causes. Trezor also expects scammers to use the incident to carry out phishing through fake emails, letters, and phone calls. Trezor dropped CryptoBilis, its authorized reseller in Southeast Asia, on October 9, after hardware wallet maker Ledger began investigating losses among Ledger customers who had bought from CryptoBilis. Ledger has since said that one affected customer's wallet contained an unauthorized hardware implant built to capture the recovery phrase during setup. Trezor says the board reported in its Safe 5 appears to work like the implants seen in Ledger devices. Trezor will not compare the two while investigations continue, because each maker builds its devices differently. It does not know who is responsible. The Singapore Police Force said in an advisory on October 28 that Ledger hardware wallets bought from some retail stores in Singapore contained malicious hardware components. At least two cases have been reported since September 10. The components could capture users' recovery phrases or private keys. Police investigations are ongoing, and Ledger is reviewing the affected cases. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. cryptocurrency, Cybercrime, data theft, hardware security, Supply Chain ⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More WhatsApp Hid Instructions in Help Pages Telling Its AI Chatbot Not to Recommend Privacy Regulators Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security Concerns Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor Generative AI Is Erasing Behavioral Tells, Weakening Behavior-Only Detection, Proofpoint Reports Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web Get the Five-Stage Identity Maturity Roadmap for Governing AI Agents Benchmark Your AI Risk Priorities Against 1,600 CISOs—Download the 2026 Report Download the 2026 Agent Security Report for a Five-Step Risk Reduction Framework No Exploit Yet? Preview the Summit Demo on Validating CVE Exposure Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Join the Webinar Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. ROI Calculator: See the Value of IAM Automation Calculate your savings on audits, app onboarding, and discovery. Try it now. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. FBI Cyber Division's Brett Leatherman Keynotes SANS CDI 2026, Dec 15 Join SANS CEO James Lyne and the FBI on ransomware disruption and intel sharing, during SANS training in D.C. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. Your Backup Isn't Ransomware-Proof Just Because It Exists Why Root and Jailbreak Detection Alone Cannot Guarantee Mobile App Security The Least Trusted Author Sets the AI Agent's Privilege Security Rests on Hard Math Problems. Quantum and AI Are Both Coming for Them