Trezor has issued a warning regarding potential hardware tampering in one of its wallets sold by the reseller CryptoBilis. This alert comes after a customer discovered an additional circuit board in their Trezor Safe 5 device, which reportedly transmits the recovery phrase via a mobile network.
Customer Discovery Sparks Concern
The issue was brought to Trezor’s attention on October 28 by a customer in Indonesia who purchased the wallet through Tokopedia in August. The device, upon inspection, contained an extra board situated between the main circuit and the screen, equipped with a cellular module and antenna, capable of sending out the recovery phrase whenever the device is powered.
Trezor has obtained photographic evidence and a detailed description from the customer and has conducted a video interview to gather more information. The company is making arrangements to analyze the device further in their laboratory.
Immediate Actions and Recommendations
In response to these findings, Trezor advises all customers who have acquired Trezor wallets from CryptoBilis since March 2026 to transfer their assets to a new wallet with a fresh recovery phrase. It is crucial not to restore the old recovery phrase on another device, as any compromised wallet might have already broadcasted it.
For those lacking a secure hardware wallet, Trezor suggests temporarily moving funds to a trusted software wallet or a reputable exchange. If the wallet has not been set up, Trezor advises against initializing it and recommends contacting their support for assistance.
Broader Implications and Future Precautions
Although no losses have been reported by CryptoBilis customers, Trezor emphasizes that the precautionary measures are necessary to prevent potential exposure. The company has severed ties with CryptoBilis as of October 9, following similar concerns raised by Ledger regarding unauthorized hardware implants in their devices sold by the same reseller.
The Singapore Police Force has also issued a separate advisory on October 28, concerning malicious hardware found in Ledger wallets sold in Singapore. Users are urged to remain vigilant against phishing attempts that may exploit this incident through deceptive emails and calls.
Trezor continues to investigate the situation but refrains from directly comparing its findings with those of Ledger, as each manufacturer employs different device architectures. The company remains committed to ensuring the security of its customers’ assets and is actively working to resolve these concerns.
