Not Just Ledger: Karpeles Warns of Tampered Trezor Devices

Mark Karpeles, former CEO of the now-defunct Mt. Gox exchange, has raised concerns about potential compromises in Trezor hardware wallets sold by Southeast Asian reseller CryptoBilis. This revelation indicates that the recent supply chain attack on Ledger devices is not an isolated incident in the cryptocurrency security landscape.

In his Oct. 30 post on X, Karpeles specifically advised customers who purchased Trezor devices from CryptoBilis since March 2026 to immediately transfer their cryptocurrency to new wallets with fresh recovery phrases. He also offered to manually review potentially compromised devices, covering shipping fees for customers who wanted their wallets checked.

Hardware implant details

Trezor confirmed its security team was made aware of a credible report about a suspected hardware implant in a Trezor Safe 5 device. The compromised device was acquired through the Indonesian online marketplace Tokopedia in August 2026. While Trezor hasn't physically examined the device, the report describes an extra board between the main board and screen containing a cellular module and antenna capable of transmitting the wallet's recovery phrase when connected to a computer.

This modus operandi mirrors the sophisticated hardware implants previously discovered in Ledger devices sold by the same reseller. Ledger's investigation into suspicious fund losses linked to CryptoBilis began on Oct. 9, confirming physical tampering in some devices. In response, Trezor severed ties with CryptoBilis as an authorized reseller on the same day.

Customer recommendations

Although Trezor has checked four CryptoBilis-sold devices without finding evidence of tampering, and no customers have reported fund losses, the company still recommends affected users create entirely new wallets rather than simply restoring existing recovery phrases on other devices. This precautionary measure aims to prevent potential unauthorized access to cryptocurrency holdings.