Trezor Issues Urgent Warning Over Potential Security Risk in CryptoBilis Wallets

Trezor Issues Urgent Warning to CryptoBilis Customers

Trezor has issued a significant warning advising users who acquired hardware wallets from the now-defunct retailer CryptoBilis to promptly relocate their cryptocurrency holdings. On October 30, the company disclosed that a security concern was raised on October 28 involving a Trezor Safe 5 wallet purchased in August 2026. The transaction took place on Tokopedia, and the buyer, based in Indonesia, reported discovering an unauthorized circuit board inside the device, which poses a serious risk of exposing sensitive data such as the wallet's recovery phrase, critical for accessing cryptocurrency assets.

Security Concerns and Investigations

In response to the report, Trezor has taken precautionary measures for all customers who procured any model of Trezor wallets from CryptoBilis since March 2026. Although no losses have been reported by customers who purchased these devices through CryptoBilis, Trezor has emphasized the credibility of the allegations after a thorough review of photos and a video consultation with the affected individual. The company is in the process of arranging laboratory analysis for the suspicious device to fully assess the situation.

The implant suspected in this incident consists of an extra circuit board located between the primary board and the device's display. This additional component includes a cellular module and antenna, which could theoretically relay information presented on the wallet's screen to external sources over a mobile network.

This alarming capability includes potential access to recovery phrases generated when the wallet is initially set up. Anyone privy to a wallet's recovery phrase could recreate the wallet on a different device, enabling fund transfers – hence the seriousness of the discovery.

Prior to reporting the finding, the Indonesian customer had already withdrawn their cryptocurrency from the wallet, possibly mitigating their exposure to losses. Trezor now faces an ongoing investigation that extends to similar alarming reports concerning Ledger devices sold through CryptoBilis; Ledger began their probe on October 9 after receiving alerts about cryptocurrency losses from their customers. Following these reports, Ledger found an unauthorized component in select wallets that captured setup recovery phrases and transmitted them via LTE, working independently from the device’s security features.

Actions Taken by Trezor

In light of ongoing concerns and investigations, Trezor ceased its partnership with CryptoBilis as an authorized seller, effective October 9, and has urged affected customers to send in their devices for inspection. By October 19, Trezor had examined several wallets, including multiple models of the Trezor devices sold through CryptoBilis, and found no evidence of tampering. However, the device linked to the implant remains separate from these evaluations.

Moreover, an alarming report from blockchain analytics firm Arkham Intelligence on October 29 detailed $95.35 million in suspected thefts across nearly 1,500 addresses, correlating with the identification of tampered Ledger wallets. Additionally, Singapore authorities reported cryptocurrency losses amounting to S$3.5 million tied to compromised Ledger devices.

Recommendations for Affected Customers

Amid this turmoil, Trezor has tightened its authorized reseller network and is collaborating with Ledger and relevant stakeholders to address these alarming security breaches. They advise customers affected by purchases from CryptoBilis since March 2026 to set up new wallets with fresh recovery phrases for maximum security, cautioning against using existing phrases due to the risk of prior exposure. For those without another secure hardware wallet, the company suggests utilizing well-known software wallets or exchanges temporarily, stressing the importance of verifying recipient addresses during transfers.

Customers who acquired a device but have yet to set it up are warned against initializing or inputting previous recovery phrases. Trezor's advisory applies broadly to all devices distributed by CryptoBilis, including various models available through Tokopedia and other channels connected to the reseller.

Trezor has instructed customers not to inspect their wallets for signs of tampering by opening them or weighing them, as such methods are unreliable. Those who purchased a device from CryptoBilis in the specified timeframe are eligible for either a replacement wallet directly from Trezor or a voucher for a new device. Customers are encouraged to retain their current hardware and reach out for support to facilitate a replacement.

Trezor further cautioned about the potential for scams arising from this situation and reminds users to never share their recovery phrases, even with individuals who may claim to represent customer support. Trezor's ongoing investigation is supported by SEAL 911, the Security Alliance’s emergency response service, assisting the company in addressing the concerns of its customers.