Trezor finds a hidden bug in one of its crypto wallets "credible"

When he opened his crypto wallet, an Indonesian buyer noticed a part that had no business being there. Between the main board and the screen of his Trezor Safe 5 sat a second printed circuit board, fitted with a cellular module and an antenna. On October 28, he reported it to the security team at Trezor, the Czech maker of hardware wallets. On October 30, Trezor published an alert.

The device was bought in August 2026 from CryptoBilis, on the Tokopedia platform. The name is already familiar. This Southeast Asian reseller is at the heart of the affair revealed in early October by Ledger, which had confirmed a hardware implant in a wallet sold by CryptoBilis.

What would this circuit do?

According to the buyer, the implant would read what is shown on the screen, including the recovery phrase. These few words make it possible to rebuild the wallet, and therefore to drain the funds. The circuit would then send this data over the mobile network as soon as the device is plugged in. Trezor stresses that it has not yet verified these claims: the company is arranging for the device to be shipped to its lab.

Still, the company considers the report "credible," based on the photos, a video interview with the buyer and his description. It says it knows of no theft of funds through this channel: the buyer had moved his funds before discovering the circuit. Trezor does not know who installed the implant and, at this stage, declines to compare the case with Ledger's. Its alert nonetheless says the implant appears to work like those found in Ledger devices.

A reseller already dropped

Trezor removed CryptoBilis from its network on October 9, as a precaution, before any sign that its own devices were affected. The same day, Ledger opened its investigation into fund losses among this reseller's customers. Trezor says it has since tightened its list of authorized resellers.

Did your device come from CryptoBilis?

The alert covers all purchases made from CryptoBilis since March 2026, whatever the model, including through shops that resold its devices, such as its Tokopedia store. Trezor recommends that you:

• do not set up a device that is still new, and do not enter any existing backup into it;
• if the device is already in use, move your funds as quickly as possible to a new wallet created with a new recovery phrase: restoring the old one on another device does not protect you;
• check the full receiving address before every transfer;
• do not rely on weighing or opening the device, which cannot reliably detect tampering;
• keep the device: eligible buyers can get a replacement or a voucher from support.

Trezor never asks for your recovery phrase: any message requesting it, in connection with this affair, is a scam. The analysis of the casing, promised once it arrives, will show whether the implant exists and whether it resembles Ledger's.