- A Trezor Safe 5 from reseller CryptoBilis reportedly contained a hidden board that transmits recovery phrases over a mobile network.
- Trezor urged all CryptoBilis buyers since March 2026 to move funds to new wallets with new recovery phrases.
- The report came from an Indonesian customer who bought the device via Tokopedia in August.
- The incident follows Ledger losses tied to CryptoBilis and a Singapore Police Force tampered-wallet advisory.
An Indonesian customer reported on October 28 that a Trezor Safe 5 hardware wallet bought from reseller CryptoBilis contained a hidden circuit board that can send recovery phrases over a mobile network, Trezor said in a blog post on October 30.
The customer purchased the device in August through Tokopedia and moved his funds before discovering the extra board. Trezor has interviewed him on a video call and is arranging for the wallet to be sent to its lab.
According to the report, the board sits between the wallet’s main board and its screen, with a cellular module and antenna. It reads the screen, including the recovery phrase, and sends the data whenever the device is plugged in.
Trezor treats the report as credible enough to warn buyers immediately. “Waiting for lab confirmation would leave CryptoBilis buyers exposed in the meantime,” the company said.
No CryptoBilis buyer has reported losing funds to Trezor. Consequently, Trezor is advising all customers who bought any model from CryptoBilis since March 2026 to move funds to a new wallet with a new recovery phrase, as restoring the old phrase on another wallet does not help.
If no secure hardware wallet is available, users should temporarily move funds to a software wallet or exchange. Trezor also advised buyers who have not set up their device to avoid doing so and never type an existing recovery phrase into it.
Trezor dropped CryptoBilis as an authorized reseller on October 9 after Ledger began investigating losses tied to the same reseller. Ledger later found that one affected customer’s wallet contained an unauthorized hardware implant designed to capture the recovery phrase during setup.
Trezor says the reported implant appears to work like those seen in Ledger devices, though it will not compare the devices while investigations continue. As of October 30, Trezor had no reports involving any other reseller.
Meanwhile, the Singapore Police Force said in an advisory on October 28 that Ledger wallets bought from some Singapore retail stores contained malicious hardware components. At least two cases have been reported since September 10, and police investigations are ongoing.
Trezor also expects scammers to exploit the incident with phishing emails, letters, and phone calls. The company cautioned that owners cannot reliably inspect a device themselves and should not open or weigh it to try.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
Previous Articles:
- Google stock crashes 13% as 5 Wall Street firms cut targets
- Israel Extradites Alexander Block to US in $2.8M Nomad Hack
- Binance hacker holds more Bitcoin than Coinbase corporate stash
- Strategy may create $30B digital credit via preferred shares
- Binance hack may involve signing manipulation, not key leak
