Trezor Says a Tampered Wallet Came From the Reseller Tied to the Ledger Thefts. How Do You Check Yours?
A customer's video interview convinced Trezor's security team to issue a public warning before even examining the device, and the reseller at the center of the alert has already been linked to tens of millions in stolen cryptocurrency.
This post may contain links from our sponsors and affiliates, and Flywheel Publishing may receive compensation for actions taken through them.
Trezor issued a warning that its security team received a credible report of a hardware implant in a Trezor Safe 5 purchased from CryptoBilis. This Southeast Asian reseller is already associated with the theft of tampered Ledger wallets. A tampered Trezor wallet could expose the recovery phrases that unlock the cryptocurrency stored within, prompting all CryptoBilis buyers to question the security of their devices.
The report originated from a customer who bought the Safe 5 in August through Tokopedia, an Indonesian online marketplace. Trezor learned of the issue on October 28. While they have yet to examine the unit, Trezor considers the customer’s account and a video interview credible enough to warrant a public notice before confirming the findings. Once Trezor receives the device for inspection, it will provide updates if any CryptoBilis customer reports a loss.
Trezor Advises CryptoBilis Buyers to Move Their Funds
Trezor’s advisory applies to anyone who has purchased a Trezor from CryptoBilis since March. The customer indicated that an extra circuit board was fitted between the main board and the screen, along with a cellular module and antenna. So far, Trezor has not received any reports of lost funds.
Trezor recommends that affected users move their funds to a different wallet with a new recovery seed and request a free replacement device or a voucher.
Owners may feel concerned because a modified device can look normal and still pass the initial setup. Trezor’s instructions were quickly shared in a Reddit thread titled “CryptoBilis update.”
The Ledger incident serves as a stark reminder of the potential risks. According to Santiment, approximately $90 million was stolen from buyers of compromised Ledger wallets. With Bitcoin (CRYPTO: BTC) approaching $77,000, even a small amount of cryptocurrency on a compromised device can represent a significant financial risk.
The Reported Implant Targets the 20 Words on the Screen, Not the PIN
A wallet backup, commonly called a recovery seed, holds the master copy of the keys. For a Safe 5, this is the set of 20 words provided on included cards. Anyone with access to these words can recover the wallet on a different device and transfer the coins elsewhere.
The report described by Trezor suggests that the implant reads the wallet backup directly from the screen and transmits it over a mobile network. Trezor has not yet verified these details.
The Secure Element chip (OPTIGA Trust M) in the Safe 5 confirms the device’s authenticity and integrity when first connected, while a PIN adds an extra layer of protection against unauthorized access. However, even hardware wallets can be compromised, as demonstrated by the $70 million Coldcard hack. The implant specifically targets the words displayed on the screen, allowing a thief to exploit them without physically handling the Trezor.
Moving funds incurs a network fee and takes about an hour, while leaving them in place puts the entire balance at risk based on a 20-word recovery phrase a thief could already possess. Trezor’s advisory does not exempt users who have set a PIN or passphrase for additional security.
Five Checks to Run on a Trezor Safe 5
- Purchase History. Verify where you bought your Trezor. If you bought it from CryptoBilis from March onward, including via Tokopedia, it falls under the warning Trezor issued. Note that Trezor removed CryptoBilis as an authorized reseller on October 9.
- Seal and Packaging. A genuine Safe 5 features a tamper-evident holographic seal over the USB-C port. Trezor states the seal should be clean, securely attached, and free from tears or residue. A properly removed seal will leave a “VOID” mark, which is normal. Both backup cards should remain blank; any printed text on them means the device should not be used.
- Authenticity and Firmware Check in Trezor Suite. Each Safe 5 ships without firmware, and Trezor Suite installs signed firmware during setup. The bootloader verifies the signature whenever the device connects, warning users if it is invalid. A positive verification normally assures buyers of authorized sellers, but Trezor still advises CryptoBilis customers to move their funds.
- Where to Buy in the Future. Trezor recommends purchasing directly from their store or from a listed authorized reseller. Exercise caution when buying from retail stores since Europe’s largest electronics retailer recently removed Ledger devices from its shelves.
- Setting Up a New Seed for CryptoBilis Buyers. Trezor urges affected owners to set up a secure device that generates a brand-new recovery seed, then transfer their coins after verifying the full receiving address. The old backup is not safe, as a thief could have already acquired those words. A software wallet or a reputable exchange can serve as a temporary solution, while any unopened CryptoBilis unit should remain sealed.
Who Needs to Move Funds From a Tampered Trezor Wallet?
We believe anyone who purchased a Trezor from CryptoBilis since March should move their funds to a new recovery seed, even though Trezor has not received any loss reports so far.
Contact [email protected] for any questions or corrections.
Sam Daodu is a crypto analyst and the editor of 24/7 Wall St.'s Crypto Desk, where he covers Bitcoin, XRP, Ethereum, Solana and the altcoins investors search for most. His work focuses on price levels, spot ETF flows, on-chain data and the regulatory decisions that move crypto markets, written so a first-time buyer and a seasoned trader can both use it.
Sam has written about crypto professionally since 2019 and has published more than 2,000 articles. Before joining 24/7 Wall St., he wrote for crypto media outlets and Web3 companies and ghostwrote for crypto founders and token launches. His analysis is syndicated on Yahoo Finance, MSN and AOL and has been cited by other crypto news sites. He also founded MacLabs Marketing, a content and personal branding agency for crypto founders and executives.
When he isn't reading charts, Sam is usually at the gym or watching One Piece, a series he maintains has better tokenomics than most altcoins.
