Trezor is now hit by the rigged wallets from reseller CryptoBilis
Trezor, the other big maker of hardware wallets for crypto, has issued an alert of its own. A customer in Indonesia says he found a small circuit board hidden in his Trezor Safe 5. It could read the secret words (the ones that give access to the crypto) shown on the screen and send them over the mobile network. Trezor has not yet been able to examine the device, and no theft has been reported so far. The wallet came from CryptoBilis, the Southeast Asian reseller already involved in the Ledger case.
If you bought a Trezor from CryptoBilis since March 2026, Trezor asks you, in its 30 October alert, to move your crypto to a new wallet, with new secret words. This summer, the brand had already been through a leak at its shipping company, where the name, address and phone number of about 80,000 customers were stolen. Crypto was not affected, but this data is being used for fake calls and fake letters in Trezor's name.
Trezor: an Indonesian customer reports an implant hidden in his Safe 5
On 28 October, an Indonesian customer reported to Trezor an implant in a Safe 5 he bought in August on Tokopedia. It is an added board, with a cellular module and an antenna, that would read the screen, recovery phrase included. Trezor has not received the device and is relying on his description and a video call. No losses are known.
On 30 October, Trezor asked people who bought from CryptoBilis since March 2026 to create a new wallet without reusing the old phrase. The device can be replaced through support. Trezor had removed CryptoBilis from its resellers on 9 October, the day of the theft from Ledger customers, and found nothing on four devices bought from it.
On 13 August, Trezor had already announced a leak at ShipMonk, its logistics provider, affecting about 13,700 customers. On 4 September, the figure rose to about 80,700, because ShipMonk had kept old US orders. No recovery phrase or private key leaked, but since then customers have received calls and letters with QR codes in Trezor's name.
Read the expert version
Trezor: a cellular implant reported in a Safe 5, not yet confirmed in the lab
The report came in on 28 October through the responsible disclosure program. On a Safe 5 bought in August 2026 on Tokopedia, in Indonesia, an added board with a cellular module and an antenna would read the screen while the seed is displayed, like the LTE implant confirmed at Ledger. Trezor has not had the device in hand or any lab confirmation, and no losses have been reported.
Trezor had removed CryptoBilis from its resellers on 9 October and inspected four of the reseller's devices (one Safe 7, two Safe 5, one Safe 3), with no sign of tampering. On 30 October, it asked anyone who bought from CryptoBilis since March 2026 to migrate to a new seed, and it replaces the device through support. It is also cutting down its reseller network. Modified Trezors sold on TikTok and Facebook had already been reported in August.
Trezor is also coming out of a leak at ShipMonk, announced on 13 August, which hit 11,742 customers (name, email, phone, address) and 1,947 others in part, for orders from 10 May to 8 August 2026. On 4 September, the total rose to about 80,700 people, with US archives from 2019 to 2021 that had never been purged. No seed, key or firmware leaked, and SatoshiLabs' infrastructure is not at fault. Targeted phishing followed, with calls citing real orders and letters with QR codes.
