Trezor Warns CryptoBilis Buyers to Move Funds After Implant Report

The warning covers every Trezor model bought through the reseller, though the reported device is specifically a Safe 5. Trezor emphasized it has no evidence of customer losses, noting the customer who discovered the suspected implant had already moved his funds before finding the tampering. The company explained that its self-custody model prevents it from seeing customer wallet balances.

Trezor received the responsible disclosure on October 28. The customer had purchased the device from CryptoBilis through Tokopedia in August 2026. At that time, CryptoBilis was an authorized Trezor reseller in Southeast Asia and remained in the company's network until October when Trezor removed it following similar investigations by Ledger.

Reported Implant Details

According to the customer's report, an extra circuit board sits between the device's main board and screen. This board includes a cellular module and antenna that allegedly reads material displayed on the screen—including wallet backups—and transmits it over a mobile network when the device is plugged in. Trezor has not verified this account itself but has received photographs and interviewed the reporter via video call.

Customer Response Required

Customers who bought from CryptoBilis since March 2026 should transfer funds to a wallet generated with a new seed. Trezor warns that using the wallet backup from a potentially tampered device on another hardware wallet doesn't solve the security issue. The replacement wallet requires a fresh backup.

Customers without another secure hardware wallet can temporarily use a software wallet or exchange, but must verify receiving addresses carefully. Those who haven't set up their CryptoBilis device should leave it uninitialized and not enter an existing wallet backup. Trezor advises against trying to determine if a device is safe by weighing or opening it.

Replacement and Scam Warning

Affected customers can receive a new device shipped directly by Trezor or a voucher covering replacement costs. The company asks eligible customers to keep their original device and arrange the replacement through Support. Trezor reports no cases involving other resellers.

The notice warns that scammers may exploit the incident through fake emails, physical letters, and phone calls. Trezor Support will never ask for wallet backups or recovery phrases. Customers are instructed never to share their recovery phrase with anyone claiming to be part of the response to this incident.

Fund Transfer Guidance

Trezor linked to its sending guide for moving funds safely. Each Suite account corresponds to a single network, and recipients must use the same network to avoid losing funds. Users should get receiving addresses directly from the destination wallet or exchange's deposit screen, not from transaction history where attackers could plant lookalike addresses through address poisoning.

In the desktop interface, Suite's account picker shows only activated networks. Users can enable missing networks under Settings, then Networks. Controls for sending native coins differ from tokens. Signing and broadcasting are separate steps—users can cancel a signed transaction before broadcast but cannot reverse it after clicking Send.

Ongoing Investigation

Trezor has not yet examined the reported device in its lab. The security team is arranging shipment for physical examination while treating the disclosure as credible. The company says the implant's operation and the identity of whoever installed it remain unconfirmed as investigations continue.

Trezor noted an apparent similarity to implants found in Ledger devices but declined direct comparisons while investigations proceed. The company is working with Ledger and other parties to share information about the tampering attempts.