Trezor Warns of Malicious Hardware Implants in Reseller Devices
Unauthorized circuit boards found in Trezor wallets sold by CryptoBilis compromise recovery phrases.
1Unauthorized Hardware Implant Discovery
A customer in Indonesia reported an extra circuit board inside a Trezor Safe 5 wallet purchased from CryptoBilis. This malicious component sits between the main board and the screen, featuring a cellular module and antenna. It captures recovery phrases displayed on the screen and transmits them via mobile network whenever the device is powered.
2Immediate Security Warning Issued
Trezor issued an urgent advisory on October 30, urging all customers who purchased devices from CryptoBilis since March 2026 to migrate funds immediately. Users must generate a new recovery phrase on a different device. The company considers the report credible enough to act before receiving the physical device for formal lab analysis.
3Scope of Affected Reseller Inventory
The warning covers every Trezor model supplied by CryptoBilis since March 2026, including units sold through marketplaces like Tokopedia. While Trezor has not confirmed reports involving other resellers, they terminated their partnership with CryptoBilis on October 9. This decision followed similar investigations into Ledger devices that also contained unauthorized hardware modifications.
4Technical Mechanism of Data Theft
The implant functions by reading the screen output during the wallet setup or backup process. By capturing the recovery phrase directly from the display interface, the device bypasses standard software security measures. The cellular module then broadcasts this sensitive information to an external party, effectively compromising the wallet's private keys and security.
5User Safety and Inspection Advice
Trezor explicitly advises owners against attempting to open or weigh their devices to detect implants. While the reporting customer noted a weight difference, such variations are unreliable indicators of tampering. Users should prioritize moving assets to a secure, verified device rather than risking physical damage or exposure by inspecting the hardware themselves.
6Broader Regional Security Context
The Singapore Police Force issued an advisory on October 28 regarding malicious hardware components found in Ledger wallets sold at retail stores. At least two cases have been documented since September 10. These incidents suggest a coordinated effort to compromise hardware wallets in Southeast Asia through supply chain attacks at the reseller level.
7Phishing and Secondary Attack Risks
Trezor warns that scammers will likely exploit this incident to launch phishing campaigns. Users should remain vigilant against fake emails, letters, or phone calls claiming to be from the company regarding the security breach. Official communication will not request private keys or recovery phrases, nor will it ask for remote access to devices.
8Ongoing Investigation and Future Outlook
Trezor is currently arranging to receive the compromised device for a detailed forensic examination in its lab. While the implant appears similar to those found in Ledger products, the company is not currently comparing the two. The identity of the perpetrators remains unknown as police investigations continue across the affected regions in Southeast Asia.
Original article: The Hacker News — Trezor Warns of Malicious Hardware Implants in Reseller Devices