Trezor warns of suspected cellular hardware implant in Safe 5 wallets sold by reseller CryptoBilis, linked to Ledger tampering
Matéria consolidada. Reúne 5 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 4 fontes trouxeram em 03/11/2026 00:02; os links antigos trazem para cá.
Fontes: helpnetsecurity.com ↗ bleepingcomputer.com ↗ gbhackers.com ↗ thehackernews.com ↗
Trezor warned on October 30, 2026 that a Trezor Safe 5 bought in August 2026 through Tokopedia from its Southeast Asian reseller CryptoBilis may contain a hardware implant. An Indonesian customer reported on 28 October (gbhackers.com), through Trezor's responsible disclosure program (helpnetsecurity.com), that the device holds an extra circuit board with a cellular module and antenna. The board allegedly reads the on-screen recovery phrase and sends it over a mobile network whenever the device is powered or plugged in. Trezor has not yet examined the device in its lab (thehackernews.com, bleepingcomputer.com), and had not yet received it as of 2 November (helpnetsecurity.com), but it considers the report credible enough to warn all buyers as a precaution. The warning covers any Trezor model supplied by CryptoBilis since March 2026. Trezor ended the CryptoBilis relationship on October 9, 2026, after Ledger began investigating losses among customers who bought from the same reseller. Trezor is working with SEAL_911 (gbhackers.com). It is not aware of any stolen funds (bleepingcomputer.com), while Ledger-related losses continue to grow; helpnetsecurity.com says CryptoBilis was also linked to the October Ledger wallet drains, with losses exceeding $93 million.
Detalhes técnicos
- The suspected implant is a supply-chain hardware modification: a secondary PCB between the mainboard and the display, with a cellular modem and antenna (thehackernews.com, bleepingcomputer.com, helpnetsecurity.com).
- It reportedly intercepts display data rather than relying on software deception, unlike OkoBot malware or Operation ASTERIX voice-phishing and fake wallet app campaigns (gbhackers.com). It would expose the recovery seed shown during wallet initialization.
- The customer supplied photographs and a video interview to Trezor's security team (gbhackers.com). The customer noticed a slight weight difference, but Trezor says weighing a device is not a reliable tamper check (thehackernews.com, bleepingcomputer.com).
- The capabilities are based on unconfirmed customer information and remain unverified pending laboratory analysis (bleepingcomputer.com, gbhackers.com).
- Attribution is unknown (thehackernews.com); Trezor also says it does not know who is behind the attack (helpnetsecurity.com).
- The customer had moved his funds before discovering the implant; no other CryptoBilis buyer has reported stolen crypto to Trezor (helpnetsecurity.com).
- On the Ledger side, the Singapore Police Force advised on October 28 that Ledger wallets bought from some Singapore retail stores contained malicious hardware components, with at least two cases since September 10 (thehackernews.com). Singapore police also reported an additional $3,500,000 in Ledger-related losses (bleepingcomputer.com).
- Ledger owners in Southeast Asia reported drained wallets from October 9; Mark Karpelès found a similar board in a tampered Ledger bought in Malaysia (helpnetsecurity.com).
- Ledger has asked Southeast Asia and Hong Kong resellers and distributors to suspend sales pending investigation (bleepingcomputer.com).
Remediação
- If the device was already set up or used, immediately move funds to a new wallet with a new recovery phrase. Do not restore the old seed on another device, because it may already have been exfiltrated.
- If no other hardware wallet is available, temporarily move funds to a trusted software wallet or exchange (thehackernews.com), and check the full receiving address (helpnetsecurity.com).
- If the device is unopened or unconfigured, do not set it up and never enter an existing recovery phrase into it.
- This applies to anyone who bought a Trezor from CryptoBilis from March 2026 onward, directly, on Tokopedia or via another store it supplied (helpnetsecurity.com).
- Keep the CryptoBilis device for the investigation. Buyers with proof of purchase can ask Trezor Support for a replacement device or voucher, through official channels only. Do not weigh or open devices to check for tampering (helpnetsecurity.com).
- Expect phishing via fake emails, physical letters and phone calls that exploit the incident. Legitimate support staff never ask for a recovery phrase.
Relatos divergentes
- Link to the Ledger implants: thehackernews.com says Trezor considers the board functionally similar to the Ledger implants but declines to compare designs during the investigation. It also says Ledger has confirmed an unauthorized implant designed to capture recovery phrases during setup. gbhackers.com says the modification resembles implants reported in Ledger wallets. bleepingcomputer.com says the implants appear similar in form and function. helpnetsecurity.com says Trezor states the implant appears to work like those in Ledger wallets. None of these sources reports a technical comparison, so the link remains unverified.
- Fund losses: gbhackers.com says no CryptoBilis customers have reported losses and that four other devices examined showed no modification. bleepingcomputer.com says Trezor is unaware of any stolen funds. helpnetsecurity.com says no other CryptoBilis buyer has reported stolen crypto to Trezor and that the reporting customer had moved his funds beforehand. Ledger-related losses are rising (more than $93 million per helpnetsecurity.com), but no loss is attributed to Trezor devices.
Linha do tempo
-
Trezor warns CryptoBilis-sold Safe 5 may hide cellular seed-stealing implant, echoing Ledger wallet drains
ler a análise desta fonte ocultar
Trezor has warned that a Trezor Safe 5 sold by the reseller CryptoBilis may contain a hidden hardware implant that steals the owner's recovery phrase. The report came from an Indonesian customer on October 28 through Trezor's responsible disclosure program; he bought the device in August from CryptoBilis' Tokopedia store. Trezor has not yet received the device but treats the report as credible and is warning buyers as a precaution. CryptoBilis was also linked to the October Ledger wallet drains, where losses exceeded $93 million.
Technical Details
- The customer found an extra circuit board between the main board and the screen, carrying a cellular module and an antenna.
- According to his account, the board reads what the screen displays, including the wallet backup, and transmits it over a mobile network whenever the wallet is plugged in.
- Trezor says the implant appears to work like those found in Ledger wallets, but it does not know who is behind the attack.
- The customer had moved his funds before discovering the implant; no other CryptoBilis buyer has reported stolen crypto to Trezor.
- Ledger owners in Southeast Asia reported drained wallets from October 9; Mark Karpelès found a similar board in a tampered Ledger bought in Malaysia.
- Trezor dropped CryptoBilis as a reseller on October 9.
Remediation
- Anyone who bought a Trezor from CryptoBilis (directly, on Tokopedia or via another store it supplied) from March 2026 onward should move funds to a newly created wallet with a new seed. Restoring the old backup on another device does not help.
- If no secure hardware wallet is available, temporarily use a software wallet or a familiar exchange, and check the full receiving address.
- Unused CryptoBilis wallets should not be set up.
- Keep the CryptoBilis unit; Trezor offers a replacement device or voucher. Do not weigh or open devices to check for tampering.
- Expect phishing by email, physical letters and phone calls exploiting the incident. Never share the recovery phrase; Trezor Support will never ask for it.
-
Trezor warns of suspected cellular crypto-theft implant in Safe 5 wallet sold by reseller CryptoBilis
ler a análise desta fonte ocultar
Trezor has issued a warning after credible reports of a suspected hardware implant inside a Trezor Safe 5 purchased from its Southeast Asian reseller CryptoBilis. An Indonesian customer who bought the device via Tokopedia in August 2026 opened it and found an extra circuit board with a cellular module and antenna placed between the main board and the screen. Based on unconfirmed customer information, the implant can read data shown on the screen, including the wallet recovery phrase, and exfiltrate it over a mobile network when the device is plugged in. CryptoBilis is the same retailer tied to the Ledger implant incident earlier in October 2026, and the implants appear similar in form and function. Trezor has not yet received the device for analysis and says it is unaware of any stolen funds, while Ledger-related losses continue to grow, including an additional $3,500,000 reported by Singapore police.
Technical Details
- Malicious supply-chain hardware implant: an additional PCB with cellular modem and antenna inserted between mainboard and display.
- Suspected capability: capture of on-screen content (recovery seed phrase) and transmission over cellular network when powered.
- Distribution channel: reseller CryptoBilis via Tokopedia, Southeast Asia; Trezor halted sales through this reseller on October 9, 2026.
- Trezor stresses that weighing devices is not a reliable tamper check.
Remediation
- Do not set up or use any Trezor device purchased from CryptoBilis from March 2026 onward.
- Users who already initialized such a device should move funds to a newly created wallet with a new recovery phrase.
- Buyers with proof of purchase may request a replacement device or voucher from Trezor.
- Ledger has asked Southeast Asia and Hong Kong resellers/distributors to suspend sales pending investigation.
-
Trezor warns of suspected cellular hardware implant in Safe 5 wallets sold by reseller CryptoBilis
ler a análise desta fonte ocultar
Trezor has issued a precautionary advisory after an Indonesian customer reported a suspected hardware implant inside a Trezor Safe 5 purchased via Tokopedia from former reseller CryptoBilis in August 2026. The customer reported the modification on 28 October 2026, providing photographs and a video interview with Trezor's security team; the device has not yet been independently verified in a lab. The alleged implant is an extra circuit board between the main board and the display, carrying a cellular module and antenna able to capture screen contents and exfiltrate them over a mobile network whenever the device is powered — potentially exposing recovery seed phrases shown during wallet initialization. Trezor had already removed CryptoBilis from its authorized reseller network on 9 October 2026 following reports of tampered Ledger devices. No CryptoBilis customers have reported fund losses so far, and four other devices examined showed no modification. Trezor is investigating with SEAL_911.
Technical Details
The reported implant sits physically between the main board and display, intercepting display data rather than relying on software deception (unlike OkoBot malware or Operation ASTERIX voice-phishing and fake wallet app campaigns). The cellular module allegedly transmits captured screen data whenever power is applied. Trezor notes the modification resembles implants previously reported in Ledger hardware wallets, pointing to a compromised distribution/supply chain rather than an application-level attack. Capabilities remain unconfirmed pending laboratory examination.
Remediation
- The warning covers all Trezor models purchased from CryptoBilis from March 2026 onward.
- Users of affected devices should move assets to a newly created wallet with a fresh seed, not restore the existing recovery phrase on another device.
- Uninitialized devices should be left unused; do not enter an existing recovery phrase.
- Retain potentially affected devices for Trezor's investigation; replacements are offered through official channels only.
- Legitimate support staff will never request a recovery phrase.
-
Trezor warns of suspected hardware implant in Safe 5 wallets sold by reseller CryptoBilis
ler a análise desta fonte ocultar
Trezor issued a warning on October 30, 2026 after a customer in Indonesia reported that a Trezor Safe 5 bought in August from authorized reseller CryptoBilis via Tokopedia contained an extra circuit board with a cellular module and antenna. The implant sits between the main board and the screen, reads the displayed recovery phrase (wallet backup) and transmits it over a mobile network whenever the device is plugged in. Trezor has not yet examined the device in its lab but considers the report credible enough to warn all buyers of any Trezor model supplied by CryptoBilis since March 2026 to move funds to a new wallet with a new recovery phrase. Trezor terminated CryptoBilis as its Southeast Asia reseller on October 9, after Ledger began investigating losses among its own customers who bought from the same reseller; Ledger has since confirmed an unauthorized hardware implant designed to capture recovery phrases during setup. The Singapore Police Force separately advised on October 28 that Ledger wallets bought from some Singapore retail stores contained malicious hardware components, with at least two cases since September 10.
Technical Details
- Implant is a secondary PCB placed between the mainboard and display of a Trezor Safe 5, equipped with a cellular modem and antenna.
- It captures the on-screen recovery phrase and exfiltrates it over the mobile network on each power-up.
- The customer noticed a slight weight difference, but Trezor says owners cannot reliably self-inspect or weigh devices to detect tampering.
- Trezor says the board appears functionally similar to implants found in Ledger devices, but declines to compare designs while investigations continue. Attribution is unknown.
Remediation
- If the device was used: immediately move funds to a new wallet with a new recovery phrase. Restoring the old seed elsewhere does not help, as it may already have been exfiltrated.
- If no other hardware wallet is available, temporarily move funds to a trusted software wallet or exchange.
- If the device is unopened/unconfigured: do not set it up and never enter an existing recovery phrase into it.
- Retain the CryptoBilis device and contact Trezor Support for a replacement device or voucher.
- Expect phishing via fake emails, letters and phone calls exploiting this incident.