The facts
An Indonesian customer reported the device on 28 October after buying it through Tokopedia in August. The report alleges an added circuit board that transmits the recovery phrase over a mobile network; Trezor treats the account as credible pending laboratory examination. [1][2][3]
The precaution covers every Trezor model supplied by CryptoBilis from March 2026 onward, including purchases through other stores. Trezor says it has no reports involving other resellers. [1][3]
Trezor advises affected buyers to use a newly created wallet and recovery phrase, avoid setting up unused devices, and contact its support team for a replacement. It says support staff never need a customer's recovery phrase. [1][2]
Relevant context
Trezor removed CryptoBilis as an authorised reseller on 9 October after Ledger began investigating losses involving devices sold by that reseller. [1][2]
Still unconfirmed
- Laboratory confirmation, the number of altered devices and who altered them remain unknown.
Sources
References support the numbered facts above. Source checks: 30 Oct 2026, 13:26 UTC.
- Implant reported in a Trezor sold by CryptoBilis
Trezor · Primary source · 30 Oct 2026
Actual manufacturer announcement and FAQ read. It establishes the warning and its scope, not independent confirmation of a physical implant or zero losses. A customer report and interview precede laboratory examination.
- Trezor warns CryptoBilis buyers after report of hardware implant in Safe 5
Decrypt · Reporting · 30 Oct 2026
Actual independently owned specialist report read. Its core evidence is the same manufacturer disclosure; it is not a separate laboratory inspection.
- Trezor warns of suspected hardware implant in one of its wallets sold by CryptoBilis
The Hacker News / Ravie Lakshmanan · Reporting · 30 Oct 2026
Actual report read. It separately reports the warning but relies on the same disclosure for the alleged implant. No exploit procedure, customer identity or unverified loss estimate is reproduced.