Hardware wallets sold by reseller CryptoBilis (Trezor Safe 5, Ledger) carry a hidden cellular implant that steals the recovery phrase

Hardware wallets sold through CryptoBilis, a Southeast Asian reseller, have been found with a hidden implant. It is an extra circuit board between the main board and the screen, with a cellular module and antenna. It reads the recovery phrase off the screen and sends it out over the mobile network (LTE). Ledger's Donjon team found it first in Ledger devices sold by CryptoBilis. Ledger says every confirmed theft involves CryptoBilis devices, and one victim lost more than 60 BTC (about $4.8M, Chainalysis). Trezor dropped CryptoBilis as a reseller on 9 Oct 2026. On 28 Oct a customer in Indonesia reported the same kind of implant in a Trezor Safe 5 bought from CryptoBilis on Tokopedia in August 2026. On 30 Oct Trezor said it treats the report as credible but has not examined the device yet, and no Trezor buyer has reported a loss. Trezor checked four other CryptoBilis units and found no tampering. At risk: anyone holding crypto on a Trezor or Ledger bought from CryptoBilis (Trezor warns about purchases since March 2026). Who is behind it is unknown, and so is the total number of units affected.

Summary written from the sources below. Check the originals before acting.