Trezor is urging anyone who bought its hardware wallets from CryptoBilis since March 2026 to move their funds to a new wallet with a new recovery phrase. The Hacker News reported that the warning follows a customer's discovery of a suspected implant designed to transmit that phrase over a mobile network, though Trezor has yet to examine the device.
The warning covers every Trezor model supplied by CryptoBilis, including purchases through other stores and its Tokopedia shop. A recovery phrase is the backup that restores access to a wallet; anyone who obtains it could gain control of the funds.
Trezor disclosed the report on October 30, two days after hearing from a customer in Indonesia who bought a Safe 5 through CryptoBilis on Tokopedia in August. The customer reported finding an extra circuit board between the wallet's main board and screen, with a cellular module and antenna. The reported implant reads screen contents, including the recovery phrase, and transmits them whenever the device is plugged in.
Trezor has reviewed the customer's photos and description, spoken with him by video and is arranging shipment to its lab. The customer had moved his funds before discovering the board. Trezor said no CryptoBilis buyer had reported losing funds to it, although it cannot see customers' holdings.
Trezor ended its relationship with CryptoBilis, formerly its authorized Southeast Asian reseller, on October 9 after Ledger began investigating customer losses linked to purchases from the seller; Ledger subsequently reported finding a recovery-phrase-capturing implant in one affected customer's wallet.
Affected owners should follow Trezor's advice:
- Move funds as soon as possible to a new wallet with a new recovery phrase. Restoring the old phrase on another device does not protect funds if that phrase was captured.
- If no secure hardware wallet is available, temporarily use a software wallet or an exchange they know.
- Leave unused devices unconfigured and never enter an existing recovery phrase into them.
- Keep the device and contact Trezor Support for a replacement or a voucher covering one. Check the receipt or contact support if the seller is unclear.
Trezor says owners cannot reliably identify tampering themselves and should not weigh or open devices to check. It also warns that scammers may exploit the incident through fake emails, letters and phone calls.
