Trezor warns CryptoBilis buyers to move funds over suspected implant

Trezor has urged customers who bought its hardware wallets from former authorized reseller CryptoBilis since March to move their funds after a report of a suspected implant in a Safe 5 device. 

Trezor said Friday that a customer in Indonesia reported an unauthorized circuit board inside a Trezor Safe 5 bought on Tokopedia in August. According to the report, the suspected implant could capture information displayed on the device’s screen, including wallet recovery phrases, and transmit it over a cellular network.

Trezor said it had not yet examined the device and had received no reports of related losses.

“We haven’t had the device in our lab yet, but we’re treating the report as credible, and we’d rather warn people now than wait for confirmation and find out someone lost their funds in the meantime,” Trezor chief commercial officer Danny Sanders told Cointelegraph. 

A Trezor spokesperson said that the company described sales through the reseller as “very small” but declined to provide figures.

The spokesperson added that Trezor has not established where the suspected tampering occurred and is reviewing its hardware protections, acknowledging that existing safeguards, including seals and packaging, are not sufficient on their own.

Ledger tampering and earlier warnings to Trezor

The warning follows reports of crypto losses involving Ledger wallets sold through CryptoBilis that surfaced on Oct. 9. Ledger confirmed an unauthorized hardware implant in one affected device.

Security researcher Joe Grand previously told Cointelegraph that he had alerted Trezor in August about tampered Trezor One and Model T wallets bought through unauthorized sellers on TikTok and Facebook. Trezor said its earlier claim of no evidence of compromised devices applied only to new wallets sold through authorized resellers.

Trezor said at the time that its setup checks targeted counterfeit devices and modified firmware, while the implant found in a CryptoBilis-sold Ledger read the screen without changing the firmware. A stolen recovery phrase can let an attacker restore a wallet on another device and move its funds.