Science & Technology2 Nov 2026 · about 6 min

Trezor Warns of Suspected Hardware Implant in One of Its Wallets Sold by CryptoBilis

The brief

A hardware wallet is a physical device designed to protect cryptocurrency keys and approve transactions. It displays a recovery phrase during setup and keeps wallet access separate from an ordinary computer or phone. A hardware implant is an unauthorized component added inside that device. It can undermine the device’s security even when the wallet’s normal software appears trustworthy. In the reported Trezor Safe 5, the extra board sat between the main board and screen. It reportedly included a cellular module and antenna. The board could read what appeared on the screen, including the recovery phrase, then transmit that information whenever the device was plugged in. Trezor had not examined the device by October 30, but considered the report credible enough to warn buyers. The customer moved his funds before finding the board. Trezor is arranging laboratory testing and will replace affected devices or provide vouchers.

What is a hardware wallet, and what does a hardware implant in one do?

In the reported Trezor Safe 5, the extra board sat between the main board and screen. It reportedly included a cellular module and antenna. The board could read what appeared on the screen, including the recovery phrase, then transmit that information whenever the device was plugged in.

Trezor had not examined the device by October 30, but considered the report credible enough to warn buyers. The customer moved his funds before finding the board. Trezor is arranging laboratory testing and will replace affected devices or provide vouchers.

What exactly was found in the Trezor Safe 5, and how could the extra circuit board capture and transmit a recovery phrase?

The reported Trezor Safe 5 contained an extra circuit board installed between its main board and screen. That matters because the added hardware could bypass the wallet’s intended protections. Trezor had not confirmed the finding in its lab by October 30, but said the customer’s photos and description were believable enough to justify an immediate warning.

The board reportedly included a cellular module and an antenna. It could read information displayed on the screen, including the recovery phrase, which Trezor calls the wallet backup. Whenever the device was plugged in, the board could send that phrase over a mobile network. The customer noticed a weight difference before discovering the modification.

Trezor is arranging to receive the wallet for examination. It says the reported board appears to work like implants found in some Ledger devices, but does not know who is responsible. Owners should not open or weigh devices themselves as a test.

How broad is Trezor's warning— which models, sellers, stores, and purchase dates are included?

Trezor’s warning is broader than the single Safe 5 reported by an Indonesian customer. It covers every Trezor model bought from CryptoBilis since March 2026. The warning applies regardless of which Trezor model a buyer received, because the company cannot yet establish how widely the supply-chain problem may extend.

It also covers purchases from any store that sold devices supplied by CryptoBilis. That includes CryptoBilis’s store on Tokopedia, where the customer bought his wallet in August. Buyers who are unsure should check the seller’s name on their receipt or contact Trezor Support rather than guessing.

Trezor dropped CryptoBilis as an authorized reseller in Southeast Asia on October 9. As of October 30, Trezor had no reports involving another reseller. Affected users should move funds, preserve the device, and contact support for a replacement or voucher.

What could happen to a user's cryptocurrency if a malicious device sends out the recovery phrase?

A recovery phrase is the backup that restores access to a cryptocurrency wallet. If a malicious device sends that phrase to someone else, the recipient may be able to restore the wallet and transfer its funds. The risk is serious because the attacker does not need to keep the physical device to use the leaked phrase.

The reported Trezor board could read the recovery phrase from the Safe 5’s screen and send it through a cellular connection whenever the device was plugged in. A buyer might therefore believe the wallet was protected while the phrase had already left the device. Restoring that same phrase elsewhere would not remove the exposure.

No CryptoBilis buyer had reported losing funds to Trezor by October 30. The customer who found the board had moved his funds beforehand. Trezor nevertheless advised immediate migration to a new wallet and new recovery phrase.

Why is restoring the old recovery phrase on a different device not enough to protect the funds?

Restoring a recovery phrase on another device does not create a new secret. It recreates the same wallet using the same backup information. If a tampered device has already captured and transmitted that phrase, moving it to a different wallet cannot undo the disclosure.

Trezor specifically warned that restoring the old phrase elsewhere would not help. In the reported case, the extra circuit board could read the phrase from the screen and send it over a mobile network whenever the wallet was plugged in. Anyone receiving it could potentially use the phrase to access the corresponding wallet, even after the owner changed devices.

The safe response is to create a completely new wallet with a new recovery phrase and move funds there. Trezor advised using another secure hardware wallet, or temporarily a trusted software wallet or exchange. Owners should keep the CryptoBilis device and contact Trezor Support.

How can a reseller or supply chain become a security risk even when the original wallet maker's software and design are trusted?

A wallet maker can design secure software and hardware, yet the supply chain can create a separate risk. Devices pass through sellers, distributors, and marketplaces before reaching customers. If someone alters a device during that process, the final product may no longer match the maker’s tested design, even though its branding and software appear genuine.

The reported Safe 5 illustrates this problem. A customer bought it from CryptoBilis through Tokopedia. The device reportedly contained an extra board between the main board and screen, with a cellular module and antenna. That board could read the displayed recovery phrase and transmit it whenever the wallet was plugged in.

Trezor dropped CryptoBilis on October 9 and warned buyers of every model supplied through the reseller since March 2026. Ledger was also investigating losses among customers who bought from CryptoBilis. These cases show why provenance, authorized sellers, and physical-device checks matter, although Trezor says owners should not open devices themselves.

What is a cryptocurrency recovery phrase, and why does possession of it usually allow someone to control the wallet's funds?

A cryptocurrency recovery phrase is a sequence of words used as a wallet backup. It lets the owner restore access if the physical wallet is lost, damaged, or replaced. Because the phrase represents the wallet’s underlying access, it must be kept secret and never entered into an untrusted device.

The Trezor report shows how exposure can happen. The suspected extra board could read the phrase displayed during setup, including what Trezor calls the wallet backup. It reportedly sent the information through a cellular module whenever the device was plugged in. Someone receiving the phrase could use it to restore the wallet elsewhere.

That usually gives the holder control over the wallet’s cryptocurrency. Trezor told affected customers to create a new wallet with a new phrase and move their funds. No CryptoBilis buyer had reported losses to Trezor by October 30, and the reporting customer moved his funds first.

This brief was written by AI from the original reporting and checked by other models. Names, figures and quotes come from the source; read it for full context.