Trezor warns some of its wallets may hide a seed-stealing implant

A Trezor Safe 5 sold by CryptoBilis, the reseller linked to the recent Ledger wallet drains, may contain a hidden implant that steals the owner’s recovery phrase, Trezor has warned.

Trezor is a Czech company and part of SatoshiLabs Group. It has made hardware wallets since 2014, and its current models are the Safe 3, Safe 5 and Safe 7.

“If you bought a Trezor from CryptoBilis from March 2026 onwards and are using it to store funds, please move your funds to a newly created wallet with a new seed as soon as possible,” the company advised.

“If you don’t have a secure hardware wallet available, we recommend temporarily migrating your funds to a software wallet or an exchange you are familiar with. Before sending any funds, carefully check the full receiving address to avoid any mistakes,” it added.

The warning comes at a bad time for crypto holders, a day after Binance disclosed that about $6.3 billion in cryptocurrency had been stolen from its wallets in what analysts believe could be the biggest crypto theft on record.

A customer in Indonesia reported the implant to Trezor on October 28, through the company’s responsible disclosure program. He bought the Safe 5 in August from CryptoBilis’ store on Tokopedia.

At the time of writing, Trezor has still not received the device, but based on the customer’s description and a video interview, it is treating the report as credible and has decided to warn buyers as a precaution.

“Waiting for lab confirmation would leave CryptoBilis buyers exposed in the meantime,” the company explained.

Extra board behind the screen

The customer found an extra circuit board between the wallet’s main board and the screen, with a cellular module and an antenna on it. He told Trezor the board reads what the screen shows, including the wallet backup, and sends that data out over a mobile network whenever the wallet is plugged in.

According to Trezor, the implant appears to work like the ones found in Ledger wallets, though the company won’t compare the two cases further and doesn’t know who is behind the attack.

A Trezor community specialist told users on the r/TREZOR subreddit that the company is still researching the matter and “we are going to tighten security checks on our resellers.”

The Indonesian customer had moved his funds off the wallet before he found the implant, and no other CryptoBilis buyer has reported stolen crypto to Trezor.

The earlier Ledger thefts

Ledger owners in Southeast Asia started reporting drained wallets on October 9. Ledger, which is based in Paris, later said all confirmed cases involved devices bought from CryptoBilis, and that one of them had an unauthorized hardware implant inside. On-chain researchers put the losses at more than $93 million.

Former Mt. Gox CEO Mark Karpelès bought a tampered Ledger in Malaysia and found a similar board under its screen. “The implant just monitors what’s shown on the screen, will take note of the seed as it’s shown to you, then transmit it,” he said at the time.

CryptoBilis sold Trezor wallets in the region too. Trezor dropped it as a reseller on October 9 and has since cut down the number of sellers it works with.

Advice for Trezor buyers

Trezor’s guidance covers every model bought from CryptoBilis, whether directly, on Tokopedia or in another store it supplied. “If you’re not sure where your device came from, check the seller name on your receipt or contact Support,” the company suggests.

Restoring the old backup on another device won’t help, Trezor noted, and anyone whose wallet is still unused should not set it up.

Buyers can get a new device or a voucher from the company, and should keep the CryptoBilis unit. Trezor also tells owners not to weigh or open their wallets to check for tampering. The Indonesian customer did spot a weight difference, but small differences can have other causes, and there is no dependable way for users to inspect a device on their own.

“Scammers will likely use this incident to target crypto holders with phishing attacks, such as fake emails, physical letters and phone calls,” Trezor cautioned.

“NEVER share your wallet backup (recovery phrase) with anyone. Trezor Support will never ask for it,” the company concluded.