Emerging Threats

Trezor Exposes Possible Hardware Implant in Wallets Sold by CryptoBilis

Analyst 207||Source: TheHackerNews
Disassembled Trezor wallet reveals suspicious extra circuit board with cellular module.

"Waiting for lab confirmation would leave CryptoBilis buyers exposed in the meantime," Trezor said.

The reported Safe 5 implant

A customer in Indonesia reported on Oct. 28 that a Trezor Safe 5 hardware wallet he bought from the reseller CryptoBilis in August contained an extra circuit board, Trezor said in a blog post on Oct. 30. According to the customer's photos and description, the board sits between the wallet's main board and its screen and includes a cellular module and an antenna.

The report says the board reads the screen — including the wallet backup, which Trezor calls the recovery phrase — and sends that information over a mobile network whenever the device is plugged in. Trezor has interviewed the customer on a video call, has his photos and description, and is arranging for the physical device to be sent to its lab for examination.

Trezor reminded buyers that the company cannot see what customers hold in their wallets and that, as of Oct. 30, no CryptoBilis buyer had reported losing funds to a Trezor device. The customer who reported the implant had moved his funds off the wallet before he found the board.

Trezor's guidance to buyers who purchased from CryptoBilis since March 2026

  • If you already use the wallet, move your funds to a new wallet with a new recovery phrase as soon as possible. Restoring the old recovery phrase on another device does not help, because a tampered wallet could already have sent that phrase out.
  • If you have no other secure hardware wallet, move the funds for now to a software wallet or an exchange you know.
  • If you have not set up the wallet, do not set it up, and never type your existing recovery phrase into it.
  • Keep the CryptoBilis device and contact Trezor Support. Trezor will ship you a new device or give you a voucher that covers the cost of one.
  • If you are not sure where your device came from, check the seller's name on your receipt or contact Trezor Support.

CryptoBilis, Ledger investigations, and the Singapore Police advisory

Trezor said it dropped CryptoBilis, its authorized reseller in Southeast Asia, on Oct. 9 after hardware wallet maker Ledger began investigating losses among Ledger customers who had bought from CryptoBilis. Ledger has said that one affected customer's wallet contained an unauthorized hardware implant built to capture the recovery phrase during setup.

Trezor told readers that the board reported in its Safe 5 appears to work like the implants seen in Ledger devices, but the company said it will not compare the two while investigations continue and that it does not know who is responsible.

Separately, the Singapore Police Force published an advisory on Oct. 28 saying that Ledger hardware wallets bought from some retail stores in Singapore contained malicious hardware components. The police advisory said at least two cases have been reported since Sept. 10, that the components could capture users' recovery phrases or private keys, and that police investigations are ongoing. Ledger is reviewing the affected cases, the advisory said.

Practical constraints for owners and the risk of follow-on scams

Trezor warned owners that they cannot reliably check a device themselves and should not weigh or open it to try to discover tampering. The customer who reported the implant noticed a weight difference, but Trezor said small differences can have other causes. The company also expects scammers to exploit the incident with phishing through fake emails, letters, and phone calls.

For affected customers, Trezor's operational offer is concrete: keep the device, contact Trezor Support, and the company will either ship a replacement device or issue a voucher to cover the cost.

What this means for end users, resellers, and investigators

  • End users: Follow Trezor's guidance immediately — move funds to a new wallet with a new recovery phrase, or to a trusted software wallet or exchange if you lack another secure hardware device. Do not set up suspect devices or enter an existing recovery phrase into them.
  • Resellers: CryptoBilis has been dropped by Trezor; any seller that received devices from CryptoBilis should expect scrutiny and customer questions. Buyers who are unsure of provenance should check receipts or contact Trezor Support.
  • Investigators and manufacturers: Trezor has moved the physical device to its lab and declined public comparisons while investigations continue. The parallel findings reported by Ledger and the Singapore Police Force mean multiple examinations and law-enforcement inquiries are underway.

The facts in the public record are straightforward but unresolved: a customer-reported implant with a cellular transmitter is now en route to Trezor's lab, Trezor has issued immediate consumer guidance for devices supplied by CryptoBilis since March 2026, and related investigations — including Ledger's internal review and a Singapore Police advisory — remain active. Who placed the hardware, how widespread any tampering may be, and the final technical assessments will depend on the lab work and the ongoing inquiries.

Original story

CryptocurrencyEmerging ThreatsSupply ChainIndonesiaHardware WalletTrezorCryptobilisHardware Implant
Related Intelligence

Continue Reading

Rows of computer servers and networking equipment in a brightly-lit server room with a single laptop in the foreground.

GitLab Flaw Exploited in Wild After CISA Warning

GitLab patched a critical flaw that allowed hackers to run malicious code on its servers, thanks to a warning from CISA. The vulnerability, known as CVE-2026-97229, was caused by a weakness in GitLab's CI/CD Regular Expression Compiler that wasn't properly validating user input.

Analyst 207
US government network operations room with concerned technicians amidst rows of computer servers and equipment.

Chinese Actor Exploits Chained Vulnerabilities to Breach US Government Network

In a shocking breach, a Chinese actor exploited a chain of vulnerabilities in under 15 minutes to gain persistent root access to 25 Palo Alto Networks servers and infiltrate a US government-affiliated Active Directory domain. The attack combined the PHP2Shell and Fragnesia exploits into a single, automated request, highlighting the devastating potential of chained vulnerabilities.

Analyst 207
Cryptocurrency exchange office with computer workstations and cityscape view.

Binance Discloses $6.3bn Hack, Foils $3bn in Stolen Funds

Binance revealed a massive $6.3 billion hack, but in a major win, the company managed to freeze around $3 billion of the stolen funds, ensuring customers won't bear the brunt of the loss. The crypto exchange is covering the losses from its own funds, reassuring users that their assets remain safe.

Analyst 207
Cluttered developer workspace with laptop and monitor, surrounded by coffee cups and notes near a window.

Malware Infects 5,000 via Compromised VS Code Extension

A malicious VS Code extension infected up to 5,000 users after the Cursor Marketplace was compromised, putting their systems at risk. The malware has since been removed and affected users will be contacted directly.

Analyst 207