Trezor warns CryptoBilis-sold Safe 5 may hide cellular seed-stealing implant, echoing Ledger wallet drains
Trezor has warned that a Trezor Safe 5 sold by the reseller CryptoBilis may contain a hidden hardware implant that steals the owner's recovery phrase. The report came from an Indonesian customer on October 28 through Trezor's responsible disclosure program; he bought the device in August from CryptoBilis' Tokopedia store. Trezor has not yet received the device but treats the report as credible and is warning buyers as a precaution. CryptoBilis was also linked to the October Ledger wallet drains, where losses exceeded $93 million.
Detalhes técnicos
- The customer found an extra circuit board between the main board and the screen, carrying a cellular module and an antenna.
- According to his account, the board reads what the screen displays, including the wallet backup, and transmits it over a mobile network whenever the wallet is plugged in.
- Trezor says the implant appears to work like those found in Ledger wallets, but it does not know who is behind the attack.
- The customer had moved his funds before discovering the implant; no other CryptoBilis buyer has reported stolen crypto to Trezor.
- Ledger owners in Southeast Asia reported drained wallets from October 9; Mark Karpelès found a similar board in a tampered Ledger bought in Malaysia.
- Trezor dropped CryptoBilis as a reseller on October 9.
Remediação
- Anyone who bought a Trezor from CryptoBilis (directly, on Tokopedia or via another store it supplied) from March 2026 onward should move funds to a newly created wallet with a new seed. Restoring the old backup on another device does not help.
- If no secure hardware wallet is available, temporarily use a software wallet or a familiar exchange, and check the full receiving address.
- Unused CryptoBilis wallets should not be set up.
- Keep the CryptoBilis unit; Trezor offers a replacement device or voucher. Do not weigh or open devices to check for tampering.
- Expect phishing by email, physical letters and phone calls exploiting the incident. Never share the recovery phrase; Trezor Support will never ask for it.
Linha do tempo
-
Trezor warns CryptoBilis-sold Safe 5 may hide cellular seed-stealing implant, echoing Ledger wallet drains
ler a análise desta fonte ocultar
Trezor has warned that a Trezor Safe 5 sold by the reseller CryptoBilis may contain a hidden hardware implant that steals the owner's recovery phrase. The report came from an Indonesian customer on October 28 through Trezor's responsible disclosure program; he bought the device in August from CryptoBilis' Tokopedia store. Trezor has not yet received the device but treats the report as credible and is warning buyers as a precaution. CryptoBilis was also linked to the October Ledger wallet drains, where losses exceeded $93 million.
Technical Details
- The customer found an extra circuit board between the main board and the screen, carrying a cellular module and an antenna.
- According to his account, the board reads what the screen displays, including the wallet backup, and transmits it over a mobile network whenever the wallet is plugged in.
- Trezor says the implant appears to work like those found in Ledger wallets, but it does not know who is behind the attack.
- The customer had moved his funds before discovering the implant; no other CryptoBilis buyer has reported stolen crypto to Trezor.
- Ledger owners in Southeast Asia reported drained wallets from October 9; Mark Karpelès found a similar board in a tampered Ledger bought in Malaysia.
- Trezor dropped CryptoBilis as a reseller on October 9.
Remediation
- Anyone who bought a Trezor from CryptoBilis (directly, on Tokopedia or via another store it supplied) from March 2026 onward should move funds to a newly created wallet with a new seed. Restoring the old backup on another device does not help.
- If no secure hardware wallet is available, temporarily use a software wallet or a familiar exchange, and check the full receiving address.
- Unused CryptoBilis wallets should not be set up.
- Keep the CryptoBilis unit; Trezor offers a replacement device or voucher. Do not weigh or open devices to check for tampering.
- Expect phishing by email, physical letters and phone calls exploiting the incident. Never share the recovery phrase; Trezor Support will never ask for it.