Trezor urges CryptoBilis customers to move funds

Trezor urged customers who bought hardware wallets from former authorized reseller CryptoBilis since March to move their funds after an Indonesian customer reported a suspected implant in a Trezor Safe 5 device.

The customer bought the wallet on Tokopedia in August and reported finding an unauthorized circuit board inside it. The reported implant could capture information displayed on the device’s screen, including a recovery phrase, and transmit it over a cellular network, according to Trezor.

The company has not examined the device in its laboratory and has received no reports of related financial losses. Trezor is treating the report as credible and issued the warning before confirming how the device was altered.

“We haven’t had the device in our lab yet, but we’re treating the report as credible, and we’d rather warn people now than wait for confirmation and find out someone lost their funds in the meantime,” Trezor Chief Commercial Officer Danny Sanders said.

A Trezor spokesperson described sales through CryptoBilis as very small but did not provide figures. The company has not determined where the suspected tampering occurred and is reviewing its hardware protections. Trezor acknowledged that safeguards such as seals and packaging cannot prevent tampering on their own.

The warning follows reports of crypto losses involving Ledger wallets sold through CryptoBilis that surfaced on Oct. 9. Ledger confirmed that one affected device contained an unauthorized hardware implant.

Security researcher Joe Grand alerted Trezor in August about tampered Trezor One and Model T wallets bought through unauthorized sellers on TikTok and Facebook. Trezor previously reported no evidence of compromised devices in new wallets sold through authorized resellers.

Trezor’s device checks were designed to detect counterfeit wallets and modified firmware. The implant found in the CryptoBilis-sold Ledger device reportedly read information from the screen without changing the wallet’s firmware.

A recovery phrase is a set of words that can restore access to a crypto wallet on another device. Anyone who obtains it may be able to access the wallet and transfer its funds.

Trezor announced plans on Oct. 13 to reduce its reseller network.