Trezor is warning about a suspected hidden part in a wallet sold by one reseller. Here is who is at risk and what to do now.
Trezor, a maker of crypto wallets, is warning about a suspected hidden part found inside one of its devices. The device was a Trezor Safe 5 sold by a reseller called CryptoBilis in Southeast Asia. If you bought a Trezor from that reseller in March 2026 or later, do not set it up. If you already set it up, move your funds to a new wallet with a new recovery phrase.
What happened
A hardware wallet is a small physical device. It stores the secret keys that control your cryptocurrency. It also approves your payments. A reseller is a shop that sells a brand's products but is not the brand itself.
According to BleepingComputer, Trezor received credible reports about a suspected implant in a Safe 5. An implant is an extra part secretly added to a device. The report came from a user in Indonesia. This user bought a Safe 5 from CryptoBilis through Tokopedia in August 2026.
When the user opened the device, they found an extra circuit board. It sat between the wallet's main board and its screen. It had a cellular module and an antenna. A cellular module is the part that lets a device connect to a mobile network, like a phone does.
Trezor has not yet examined the device. It is being shipped to the company now. So the implant is not confirmed yet. Trezor says it is not aware of any funds stolen this way. It promised to share updates once it has the device.
How the hidden part could steal your crypto
A recovery phrase is a list of words. It is the master backup for your wallet. Anyone who has those words can take your funds. The wallet shows this phrase on its screen when you set it up.
Based on information from the customer, which is not yet confirmed, the extra board appears able to read what the screen shows. That includes the recovery phrase. It could then send that information over a mobile network when the device is plugged in.
This is called a supply-chain attack. It means someone changes a product before it reaches the buyer. The box and the device can look normal. Trezor also says that weighing a device is not a reliable way to tell if it was changed.
Hardware is not the only target. The Hacker News reports on fake GitHub projects that claim to be desktop apps for ChatGPT and Claude. Instead, they install a cryptocurrency miner. A miner is a program that uses your computer's power to make crypto for someone else.
A similar report about Ledger
CryptoBilis is the same reseller named in a Ledger implant case earlier in October. Ledger is another maker of hardware wallets. The implants in the two devices appear similar in form and function.
- Ledger later confirmed the compromise.
- Ledger asked resellers and distributors in Southeast Asia and Hong Kong to stop all sales until its investigation confirms they are safe.
- Multiple reports of losses by Ledger users have come out since then.
- A recent Singapore police announcement added another $3,500,000 to the total losses.
Trezor stopped selling devices through CryptoBilis on October 9, 2026. It did this after the Ledger case, before it had any sign its own devices were affected. Trezor also said it will restructure and tighten its reseller network around the world.
Who is at risk
Based on the report, you may be at risk if:
- You bought a Trezor device through CryptoBilis in March 2026 or later.
- You bought from that reseller on an online marketplace, such as Tokopedia, where the reported device was sold.
- You already set up that device and stored crypto on it.
If you bought your wallet somewhere else, this specific warning does not cover your device. The Safe 5 is also sold on Trezor's official store.
What to do now
Here are the steps Trezor recommends, in plain order:
- Check where you bought it. Look at your receipt or order history.
- If it came from CryptoBilis in March 2026 or later, stop. Do not set up or use the device.
- If you already set it up, move your funds. Send them to a newly created wallet with a new recovery phrase. Do not reuse the old phrase, because it may have been seen.
- Keep your proof of purchase. With it, you can contact Trezor for a replacement device or a voucher for a new one.
- Do not trust a scale. Weighing the device will not reliably show if it was changed.
- Watch for updates. Trezor said it will share more once it examines the device.
If you own a Ledger bought from the same reseller, look for guidance from Ledger directly. The steps above come from Trezor and apply to Trezor devices.
Have a question about anything here? Email me at sales@appwt.com or call (888) 565-0171, and I will answer it.
Sources
- Trezor warns of suspected crypto-theft implant in hardware wallet, BleepingComputer, 2026-10-30
- Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto Miners, The Hacker News
Tags
Frequently Asked Questions
Has anyone lost money from the Trezor device?
Trezor says it is not aware of any funds stolen from this. Separate reports of losses have come from Ledger users. A Singapore police announcement added another $3,500,000 to those losses.
Is the hidden part confirmed?
Not yet. Trezor has not examined the device. It is being shipped to the company, and Trezor promised updates.
Which devices are part of this warning?
Trezor says not to set up or use any device bought through CryptoBilis in March 2026 or later. CryptoBilis is a reseller in Southeast Asia.
Can I weigh my wallet to check it?
No. Trezor says weighing a device is not a reliable way to tell if it was tampered with.
What if I already used one of these devices?
Move your funds to a newly created wallet with a new recovery phrase. If you have proof of purchase, you can contact Trezor for a replacement or a voucher.
Enjoyed this article?
Share it with your network
