A Cellular Chip Inside a Trezor? Reseller CryptoBilis Strikes Again
Trezor is investigating a suspected cellular implant in a Safe 5 sold by Southeast Asian reseller CryptoBilis, the retailer behind a confirmed Ledger implant earlier in October.
Trezor says it has “credible reports” of a hidden hardware implant inside a Trezor Safe 5 wallet sold by CryptoBilis, a reseller in Southeast Asia, BleepingComputer reports. An Indonesian buyer opened the device and found an extra circuit board with a cellular modem and antenna. CryptoBilis is the same retailer tied to a confirmed Ledger implant case earlier this month.
For defenders
What was found: one customer, who bought a Safe 5 from CryptoBilis through the marketplace Tokopedia in August, reported an added board sitting between the main board and the screen. According to the customer, whose account Trezor hasn’t verified, it can read what the screen shows, including the recovery phrase during setup, and send it out over a mobile network when the wallet is plugged in. That’s a supply-chain interdiction, T1195.003 (Supply Chain Compromise: Compromise Hardware Supply Chain).
Status: suspected, not confirmed. Trezor hasn’t examined the device yet; it’s being shipped to them. BleepingComputer says the implant looks similar in form and function to the one Ledger confirmed in its own CryptoBilis-sold device, and Ledger users have reported losses since early October, with a Singapore police advisory adding $3.5 million. Trezor says it knows of no funds stolen this way from its customers. It cut off CryptoBilis on Oct. 9 and plans to tighten its reseller network worldwide.
Detection: Trezor warns that weighing a device isn’t a reliable tamper check. The only clean answer is a wallet bought directly from the manufacturer or an authorized reseller, set up with a fresh recovery phrase.
What it means for you
A hardware wallet is supposed to keep your crypto safe even if your computer is hacked. This attack goes around that by tampering with the wallet before you ever get it, so whoever planted the chip learns your recovery phrase, the master key to your coins. If you bought a Trezor or Ledger from CryptoBilis, or from a marketplace listing you can’t trace back to an official seller, treat that wallet as compromised.
Do this now
- If your wallet came from CryptoBilis any time since March 2026, don’t set it up or use it. Trezor says to contact them with proof of purchase for a replacement or voucher.
- If you already set one up, move your funds now to a new wallet with a brand-new recovery phrase. Don’t reuse the old phrase anywhere.
- Buy hardware wallets only from the manufacturer’s own store or the authorized resellers it lists on its website, never a third-party marketplace seller.