Trezor Warns CryptoBilis Buyers of a Suspected Implant in Safe 5

Trezor told customers on Friday to move their funds if they bought any of its wallets from the Southeast Asian reseller CryptoBilis at any point since March. The warning follows a report from a buyer in Indonesia who found an extra circuit board inside a Trezor Safe 5, sitting between the main board and the screen and carrying a cellular module and an antenna. Trezor has not had the device in its hands. It published anyway, on the strength of photographs, the customer's account and a video interview with him. No CryptoBilis buyer has reported a loss of funds to the company.

Published before the lab, and said so

The customer bought the wallet through the Tokopedia marketplace in August and reported it to Trezor's disclosure programme on 28 October. According to that report, which Trezor has not verified, the board reads what the screen displays, the wallet backup included, and transmits it over a mobile network whenever the device is plugged in. The wallet backup is the recovery phrase a hardware wallet shows once during setup; anyone holding it holds the coins. Trezor said what it had seen looked sophisticated enough to warrant a warning before any laboratory work.

"Waiting for lab confirmation would leave CryptoBilis buyers exposed in the meantime," the company said.

Decrypt and The Hacker News both carried that sentence in identical wording on Friday. Trezor is arranging to receive the wallet for examination and says it does not know who is responsible. It also says the board appears to operate like the implants Ledger found in its own devices, and will not draw the comparison further while investigations run.

The phrase is the thing to replace

Anyone who bought a Trezor from CryptoBilis from March onward is told to create a new wallet with a new phrase and move funds to it. Restoring the old phrase on a different device achieves nothing. Buyers who have not set a device up are told not to use it. The device can be kept. Trezor Support is handling replacements and vouchers. One instruction cuts against instinct: owners should not open or weigh the wallet to check it. The customer in Indonesia did notice a weight difference, but small differences have other causes. Trezor expects phishing calls, emails and letters built on the incident, as the Ledger case did, after which OneKey published its own photo check for tampered boards in mid-October.

Singapore had counted two cases already

The same week brought a police advisory. On 28 October the Singapore Police Force said Ledger hardware wallets bought from some retail stores in the country contained malicious hardware components able to capture recovery phrases or private keys, with at least two cases reported since 10 September. The advisory as published gives the losses as about $3.5 million without naming a currency. Several outlets read that as S$3.5 million and CoinCentral converted it to roughly $2.7 million; the two figures do not reconcile and the force has not clarified which it meant. Police are working with Ledger and investigations continue. Nothing in the advisory ties those Singapore purchases to CryptoBilis, and Trezor's Indonesian case is a separate report from a separate country.

Four devices came back clean

Trezor dropped CryptoBilis as a reseller on 9 October, after Ledger began looking into losses among its own customers who had bought from the same firm and asked the Kuala Lumpur company to pause sales. By 19 October Trezor had inspected four CryptoBilis devices, a Safe 7, two Safe 5s and a Safe 3, and found no tampering. That is the awkward part of Friday's post: the company's own sample is clean and the one suspect unit is still in Indonesia. Estimates of what the Ledger incident cost run from above $86 million on The Block's 9 October count to about $95.35 million on an Arkham Intelligence trace. They have never been squared. What the lab finds in the Safe 5 will decide whether this is one tampered unit or a second product line in the same supply chain, and Trezor has put no date on that.