Trezor Urges CryptoBilis Buyers to Move Funds After Suspected Chip Implant

Trezor is warning customers who purchased hardware wallets from former authorized reseller CryptoBilis since March to move funds off affected devices after a report of a suspected hardware implant in a Trezor Safe 5. The alert follows renewed attention on wallet tampering incidents that can expose recovery phrases—even when firmware appears unchanged.

In a post on Friday, Trezor said a customer in Indonesia reported an unauthorized circuit board inside a Trezor Safe 5 bought on Tokopedia in August. According to the customer’s account, the suspected implant could capture information shown on the device’s screen, including wallet recovery phrases, and transmit that data over a cellular network.

Key takeaways

• Trezor is advising customers who bought from CryptoBilis since March to transfer funds immediately after a suspected Safe 5 implant report.
• The suspected mechanism reportedly targets what appears on the device screen, including recovery phrases, rather than altering firmware.
• Trezor says it has not yet examined the device and has not received reports of confirmed losses tied to the case.
• Earlier tampering concerns involving other devices sold through unauthorized channels suggest the reseller controls matter for user security.
• Trezor acknowledged that existing seals and packaging are not sufficient protection on their own and is reviewing hardware defenses.

Trezor’s warning: suspected implant linked to screen capture

According to Trezor, the incident was brought to its attention via a customer report from Indonesia. The customer said the Trezor Safe 5 was purchased on Tokopedia in August and later discovered what appears to be an unauthorized circuit board inside the device.

Trezor’s explanation centers on how such a modification could compromise users. If the implant can capture the information displayed on the device screen, it may allow an attacker to learn sensitive data entered during wallet setup or recovery—most critically, the recovery phrase. With a recovery phrase in hand, an attacker can restore the wallet on another device and move funds.

Trezor said it has not examined the Safe 5 in its lab and has not received any reports of related losses. Still, the company indicated it is treating the report as credible and is acting quickly to reduce potential harm.

“We haven’t had the device in our lab yet, but we’re treating the report as credible, and we’d rather warn people now than wait for confirmation and find out someone lost their funds in the meantime,” Trezor chief commercial officer Danny Sanders told Cointelegraph.

A Trezor spokesperson added that sales through the former reseller are “very small,” but the company did not share figures. The spokesperson also said Trezor has not established where the alleged tampering occurred and is reviewing its hardware protections, acknowledging that seals and packaging alone cannot provide adequate assurance.

Why “screen capture” raises the stakes for hardware wallet users

Many people associate hardware wallet compromises with obvious changes such as altered firmware or modified software behavior. Here, the suspected threat appears different: the reported implant would read what is displayed on the screen without necessarily changing the device’s firmware.

This distinction matters for users because it undermines some assumptions about how tampered devices can be identified. If firmware integrity checks do not detect a hardware-level addition that passively captures displayed data, then safeguards that focus on counterfeit screens, altered firmware, or other software-level modifications may not be enough.

As Trezor itself previously discussed in connection with other reports, a recovery phrase can be enough for an attacker to take over the wallet on a different device. That is why Trezor’s practical guidance—move funds away from potentially affected devices—remains central even before technical confirmation is complete.

Ledger background: unauthorized implants tied to CryptoBilis

The Trezor warning arrives amid broader coverage of tampering risks associated with hardware wallets sold through CryptoBilis. Earlier reporting by Cointelegraph referenced reports of crypto losses involving Ledger wallets sold through the same reseller channel that surfaced on Oct. 9. In that earlier case, Ledger confirmed an unauthorized hardware implant in at least one affected device.

These developments highlight a common pattern: multiple hardware-wallet brands being implicated in incidents connected to the same distribution path raises questions about the controls in the resale ecosystem rather than a single vendor’s manufacturing process.

Earlier signals to Trezor and planned changes to reseller coverage

Cointelegraph previously reported that security researcher Joe Grand told Trezor in August about suspected tampered Trezor One and Model T wallets bought through unauthorized sellers on TikTok and Facebook. Trezor’s prior response, according to the coverage, was that it saw no evidence of compromised devices, but that assessment applied to new wallets sold through authorized resellers.

Trezor said at the time that its checks targeted counterfeit devices and modified firmware. In contrast, the later Safe 5 report described an implant capable of reading what the screen shows without changing firmware. That difference suggests the threat model may be evolving—or that attackers are using more than one approach to intercept recovery data.

Trezor also announced plans to reduce its reseller network on Oct. 13. While that step does not resolve the uncertainty around where tampering occurred in the Safe 5 case, it reflects the industry’s growing recognition that distribution and channel security can be as important as device-level defenses.

For now, Trezor is emphasizing uncertainty where it remains: it has not yet inspected the reported device, and it has not determined the point in the supply chain where the tampering happened. The company’s focus on reviewing hardware protections and conceding that seals and packaging are insufficient indicates it is treating this as more than a one-off complaint.

What to watch next

Customers targeted by the warning should prioritize moving funds off the potentially affected Safe 5 devices and monitor for further technical findings from Trezor once it can assess the reported unit. The critical unknown remains whether additional devices from the same reseller channel will be identified—and whether Trezor’s forthcoming hardware-focused updates address screen-capture-style implants effectively.