Trezor Warns Buyers After Report of Suspected Spy Hardware Inside a Wallet Sold by One Reseller

A customer in Indonesia has reported that a Trezor Safe 5 hardware wallet, bought from the reseller CryptoBilis through the marketplace Tokopedia in August, contained an extra circuit board. According to the report, the board sits between the main board and the screen, has a cellular module and an antenna, and reads the screen, including the recovery phrase, then sends it out over a mobile network whenever the device is plugged in. Trezor has the customer's photos and description and has interviewed him on a video call, but it has not yet examined the device. It is arranging for the wallet to be sent to its lab.

Trezor found the report believable enough to warn buyers now, saying that waiting for lab confirmation would leave CryptoBilis buyers exposed. It is telling everyone who bought a Trezor from CryptoBilis since March 2026, including through stores supplied by CryptoBilis, to move their funds to a new wallet with a new recovery phrase. No buyer has reported losing funds, and the affected customer had already moved his money off the wallet. Trezor says owners cannot reliably check a device themselves and should not weigh or open it, and it expects scammers to exploit the news with phishing emails, letters and calls.

Trezor dropped CryptoBilis as its Southeast Asian authorized reseller on October 9, after rival Ledger began investigating customer losses linked to the same reseller. Ledger has since said one affected customer's wallet held an unauthorized implant built to capture the recovery phrase during setup.