A generic hardware wallet on a precision scale, a thin gold antenna wire poking out of its casing and signal waves rising over a dark map
Original AI-generated illustration; not a real device

Trezor Warns CryptoBilis Buyers Before Its Lab Has Seen the Reported Implant

NodeWitness Team 6 min read

Trezor went public on a single customer report, photos and a video call, without the device in hand. Its reasoning is simple. Waiting for lab confirmation would leave CryptoBilis buyers exposed in the meantime.

Trezor said on October 30, 2026, that a customer in Indonesia had reported, through its responsible disclosure program, a hardware implant inside a Trezor Safe 5 bought from CryptoBilis in August via Tokopedia [1]. The report reached its security team on October 28 [1]. Trezor treats it as credible but has not examined the device [1].

That matters because CryptoBilis is the same Southeast Asian reseller at the center of the Ledger case, where Ledger Donjon confirmed screen-reading implants that sent recovery phrases out over LTE. We covered it in our report on the CryptoBilis Ledger implant. Trezor's notice is the first to put one of its own devices in that picture [1].

What the report describes

According to the customer, an extra circuit board sits between the Safe 5's main board and its screen, with a cellular module and an antenna [1]. It reads whatever the display shows, including the recovery phrase, and transmits it over a mobile network whenever the device is plugged in [1]. Trezor stresses that this is the reporter's description and that it has not verified it itself [1].

The company says the implant "appears to operate similarly to those seen in Ledger devices," but declines to draw comparisons while investigations continue [1]. "Every hardware wallet maker builds its devices differently," it says, adding that it doesn't know who is behind the attack and is working with Ledger and others investigating the incident [1].

Why Trezor went public early

Trezor has the report, photos and a video interview with the customer, and is arranging for the device to be shipped to its lab [1]. What it has seen "looks sophisticated enough that we decided to warn customers now," the company writes [1].

The warning is broad. Trezor asks anyone who bought any Trezor model from CryptoBilis from March 2026 onward to move their funds to a newly created wallet with a new seed, even though the report concerns a single Safe 5 [1]. Every such buyer can get a new device shipped directly or a voucher covering one [1].

The evidence so far cuts both ways. Trezor removed CryptoBilis as a reseller on October 9, after the Ledger reports, and has since inspected the Trezor devices customers bought there. None of the four it had received by the time of the notice showed signs of tampering [2]. It has no reports involving other resellers and no reported losses [1].

One reported implant awaiting lab work, four inspected CryptoBilis units clean, and no reported losses, as of Trezor's October 30 notice [1][2].

The buyer who moved first

The person behind the report did most things in the right order. He noticed a weight difference, had already moved his funds off the device before he found the implant, and then took it to Trezor's responsible disclosure program, following up with a video interview [1]. Trezor thanked him in its notice, along with SEAL 911, the Security Alliance's emergency response service for crypto security incidents, which worked on the response [1].

Trezor is explicit that a weight check shouldn't become a method. "Weighing isn't a reliable test," it says, and there is no dependable way for owners to inspect a device themselves [1].

Mark Karpelès, who took apart one of the tampered Ledgers, has offered on X to analyze any device people are unsure of and to cover shipping [3]. His post goes further than Trezor does, stating that Trezor devices sold by CryptoBilis "also had an implant" [3]. Trezor's own position is one credible, unverified report [1].

If you bought from CryptoBilis, whatever the brand

CryptoBilis sold several hardware wallet brands in Indonesia, Malaysia and the Philippines, and in October suspended sales of all of them, per Cointelegraph [4]. Guidance from Trezor, Ledger and the Singapore police lines up on the basics [1][5][6].

  • Check the receipt. Look for the seller name. Trezor's notice covers any store selling devices supplied by CryptoBilis, including its Tokopedia store [1].
  • Already using it? Move your funds to a new wallet with a new seed generated on a device from a trusted source. Restoring the old backup on another device does not solve the problem, because that phrase is what may have leaked [1].
  • Still sealed? Leave it that way and never enter an existing recovery phrase on it [1][5].
  • Keep the device and contact the maker's official support. Trezor offers CryptoBilis buyers since March 2026 a replacement or a voucher [1]. If you lost funds, Ledger asks you not to open or ship the device before talking to it or the police [5].
  • Treat unsolicited contact as hostile. Trezor expects phishing through fake emails, physical letters and phone calls, and says Support will never ask for your recovery phrase [1]. A tampered screen module has already been used as bait, in the fake Passport recall sent from Foundation's real domain.
  • Another brand? Apply the same caution and ask the manufacturer through its official channels, as the Singapore police advise for any suspicious device [6].

What Trezor concedes

Replying to users on X, Trezor acknowledged that "it's very hard for any device case to fully stop someone who has the device in their hands for long enough before it reaches the customer" [7]. Seals and secure packaging make tampering slower and harder, but "we know those layers aren't enough on their own," it wrote, adding that it is reviewing how it protects its devices and recommending purchases directly from trezor.io [7].

That is the provenance habit, the one that addresses this kind of attack in our breakdown of three hardware wallet attacks in 2026. The next data point is the Safe 5 itself, once it reaches Trezor's lab.

Sources

Source type in parentheses. Web pages were accessed on October 30, 2026; sources 4 and 5 are also cited in our CryptoBilis Ledger report.

  1. Trezor, Implant reported in a Trezor sold by CryptoBilis, October 30, 2026. October 28 report, August purchase via Tokopedia, implant description, device not yet examined, guidance, replacement or voucher, no losses or other resellers reported, weight, SEAL 911. (Primary, official blog)
  2. Trezor (@Trezor), CryptoBilis update, October 30, 2026. CryptoBilis removed October 9; four devices inspected with no signs of tampering. (Primary, official X account)
  3. Mark Karpelès (@MagicalTux), post on CryptoBilis Trezors, October 30, 2026. Offer to analyze devices and cover shipping. (Primary, statement on X)
  4. Cointelegraph, Ledger Says LTE Implants Copied CryptoBilis Wallet Recovery Phrases, October 13, 2026. CryptoBilis markets and its halt on all hardware wallet brands. (Secondary, press)
  5. Ledger, Update from Ledger Donjon on the CryptoBilis investigation, October 13, 2026. Guidance for CryptoBilis buyers. (Primary, official statement)
  6. Singapore Police Force, Police Advisory On Tampered Cryptocurrency Hardware Wallets, October 28, 2026. Advice for suspicious devices. (Primary, official statement)
  7. Trezor (@Trezor), reply on device protection, October 30, 2026. Limits of device cases, seals and packaging, protection review, buying direct. (Primary, official X account)

More in Privacy and self-custody

See all 30 articles in Privacy and self-custody →

Last updated: October 30, 2026