Trezor Urges CryptoBilis Buyers to Move Funds Over Suspected Safe 5 Wallet Implant
Key Takeaways
- •Trezor has advised anyone who purchased a device from its former authorized reseller CryptoBilis since March to migrate their holdings to a wallet created through a trusted channel.
- •An Indonesian buyer found an unauthorized circuit board inside a Trezor Safe 5 bought on marketplace Tokopedia in August, suspected of capturing on-screen information such as recovery phrases and relaying it via a cellular network.
- •Trezor has not yet inspected the device and has received no reports of related fund losses, but its chief commercial officer said the company is treating the report as credible and warning users proactively.
- •The alert follows Ledger's confirmation of an unauthorized implant in a wallet sold through CryptoBilis, with tampered Ledger devices linked to crypto losses, including $2.7 million among Singapore users.
- •Trezor acknowledged that seals and packaging are not sufficient safeguards on their own, is reviewing its hardware protections, and announced plans on Oct. 13 to reduce its reseller network.
Hardware wallet maker Trezor is urging customers who bought its devices from former authorized reseller CryptoBilis since March to move their funds, following a report of a suspected implant in a Trezor Safe 5.
Trezor disclosed the report on Friday in an official blog post, and the advisory was also shared on X. According to the disclosure, a customer in Indonesia found an unauthorized circuit board inside a Safe 5 purchased on marketplace Tokopedia in August. The suspected implant could capture information shown on the device's screen — including wallet recovery phrases — and transmit it over a cellular network. Hardware wallets are designed to keep recovery phrases offline, which is why a device suspected of leaking what it displays strikes at the core of the product's security model.
Trezor said it has not yet examined the device and has received no reports of related losses.
"We haven't had the device in our lab yet, but we're treating the report as credible, and we'd rather warn people now than wait for confirmation and find out someone lost their funds in the meantime," Trezor chief commercial officer Danny Sanders told Cointelegraph.
A company spokesperson described sales through CryptoBilis as "very small" but declined to provide figures. The spokesperson added that Trezor has not established where the suspected tampering occurred and is reviewing its hardware protections, acknowledging that existing safeguards — including seals and packaging — are not sufficient on their own. In practice, moving funds involves generating a new wallet with a fresh recovery phrase on a device obtained through a trusted channel, retiring any phrase that may have been displayed on the suspect device.
Ledger tampering and earlier warnings
The warning follows reports of crypto losses involving Ledger wallets sold through CryptoBilis that surfaced on Oct. 9. Ledger confirmed an unauthorized hardware implant in one of the devices.
Security researcher Joe Grand previously told Cointelegraph that he alerted Trezor in August about tampered Trezor One and Model T wallets bought through unauthorized sellers on TikTok and Facebook. Trezor said its earlier claim of no evidence of compromised devices applied only to new wallets sold through authorized resellers, adding that its setup checks targeted counterfeit devices and modified firmware — while the implant found in a CryptoBilis-sold Ledger read the screen without changing the firmware.
A stolen recovery phrase can allow an attacker to restore a wallet on another device and move its funds.
Trezor announced plans to reduce its reseller network on Oct. 13.
Related: Tampered Ledger wallets cost Singapore users $2.7M, police say
Source: Cointelegraph
