Trezor warns of tampered wallets sold through CryptoBilis

Trezor has issued an urgent security alert after investigators found a hardware tamper implant inside an altered Safe 5 unit sold through Southeast Asian distributor CryptoBilis. A buyer in Indonesia reportedly purchased the device in August 2026 and, after noticing physical anomalies, dismantled the unit on 28 October to reveal a rogue circuit sandwiched between the main board and the display.

Forensic teardown identified a custom secondary board housing an antenna and a 4G LTE transceiver, which intercepted recovery seed phrases during initial device setup and transmitted credentials over cellular networks. Trezor’s official security advisory on the CryptoBilis incident confirms that the compromised unit could expose sensitive data, though the alert noted that funds were evacuated by the affected customer prior to losses.

The incident mirrors a previously reported hardware supply chain attack against Ledger and appears linked to distribution channels managed by CryptoBilis. Intelligence analysis has connected the dealership buyout in March 2026 to North Korean state‑sponsored activity, suggesting a broader campaign targeting cryptocurrency cold storage at the distribution level.

Trezor has expanded its warning to cover all CryptoBilis-distributed models since March 2026, including orders fulfilled via third‑party marketplaces such as Tokopedia. In response, owners are advised to transfer assets to verified secure environments, generate fresh private keys on an uncompromised wallet platform, and request free replacements or store credit from Trezor. The firm emphasised purchasing devices only through direct manufacturer channels to ensure hardware integrity.