Trezor urges CryptoBilis customers to replace affected wallet backups
Trezor has warned customers who bought any of its hardware wallets from reseller CryptoBilis since March 2026 to move their funds to a new wallet protected by a new recovery phrase. The precaution follows a customer report that a Trezor Safe 5 purchased in August through CryptoBilis’s Tokopedia marketplace store contained an extra circuit board.
The report, received on October 28 from a customer in Indonesia, describes a board placed between the wallet’s main board and screen. It allegedly included a cellular module and antenna, could read what appeared on the display, and transmitted the recovery phrase—called a wallet backup by Trezor—when the device was plugged in.
Trezor acts before physical examination
Trezor has obtained photographs and a description of the device and interviewed the customer by video call. The company is arranging for the wallet to be sent to its laboratory, but said it considered the report credible enough to alert customers before that examination is complete. It said waiting for laboratory confirmation could leave CryptoBilis buyers exposed.
No CryptoBilis customer has reported lost funds to Trezor. The customer who found the board had already moved funds away from the wallet. Trezor also noted that it cannot see what customers hold in their wallets.
The company’s recommendation applies to every Trezor model obtained from CryptoBilis since March, including devices supplied by CryptoBilis to other stores. Customers already using such a wallet should transfer assets to a newly created wallet with a new recovery phrase as soon as possible.
A new device alone does not resolve phrase exposure
Restoring an existing recovery phrase on another device is not sufficient, Trezor said, because a tampered wallet may already have transmitted that phrase. Customers without another secure hardware wallet can temporarily move funds to a trusted software wallet or exchange. Those who have not configured their CryptoBilis device should not set it up and must not enter an existing recovery phrase into it.
Trezor asked owners to retain the device and contact Trezor Support. It said it will provide a replacement device or a voucher covering one. Customers uncertain about a device’s origin should check the seller listed on their receipt or contact support.
Reseller investigation follows similar Ledger reports
Trezor ended CryptoBilis’s status as an authorised reseller in Southeast Asia on October 9, after Ledger began investigating losses involving Ledger customers who had bought from the reseller. Ledger has said an affected customer’s wallet included an unauthorised implant designed to capture the recovery phrase during setup. Trezor said the reported Safe 5 board appeared to operate similarly, while declining a direct comparison as investigations continue.
On October 28, the Singapore Police Force separately advised that Ledger wallets purchased from certain Singapore retail stores contained malicious hardware components. At least two cases had been reported since September 10, and the components could capture recovery phrases or private keys.
Trezor said owners cannot reliably verify a device themselves and should not open or weigh it in an attempt to do so. It also expects phishing attempts using fake emails, letters, and phone calls. For businesses and asset holders, the immediate implication is to verify reseller provenance, preserve suspect hardware, and replace any recovery phrase that could have been displayed on a potentially altered device.