{"id":"CMP-202610-hardware-wallets-sold-by-reseller-cryptobilis-trezor-safe-5-","kind":"campaign","aliases":[],"related":[],"title":"Hardware wallets sold by reseller CryptoBilis (Trezor Safe 5, Ledger) carry a hidden cellular implant that steals the recovery phrase","description":null,"summary":"Hardware wallets sold through CryptoBilis, a Southeast Asian reseller, have been found with a hidden implant. It is an extra circuit board between the main board and the screen, with a cellular module and antenna. It reads the recovery phrase off the screen and sends it out over the mobile network (LTE). Ledger's Donjon team found it first in Ledger devices sold by CryptoBilis. Ledger says every confirmed theft involves CryptoBilis devices, and one victim lost more than 60 BTC (about $4.8M, Chainalysis). Trezor dropped CryptoBilis as a reseller on 9 Oct 2026. On 28 Oct a customer in Indonesia reported the same kind of implant in a Trezor Safe 5 bought from CryptoBilis on Tokopedia in August 2026. On 30 Oct Trezor said it treats the report as credible but has not examined the device yet, and no Trezor buyer has reported a loss. Trezor checked four other CryptoBilis units and found no tampering. At risk: anyone holding crypto on a Trezor or Ledger bought from CryptoBilis (Trezor warns about purchases since March 2026). Who is behind it is unknown, and so is the total number of units affected.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-10-30T12:35:31+00:00","products":[{"name":"Trezor Safe 5","fixed":[],"affected":"units bought from reseller CryptoBilis since March 2026","ecosystem":"hardware"},{"name":"Ledger","fixed":[],"affected":"hardware wallets bought from reseller CryptoBilis","ecosystem":"hardware"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Check where each hardware wallet (Trezor, Ledger) was bought. Treat any unit bought from CryptoBilis, including through Tokopedia or other marketplaces, since March 2026 as compromised. Signs of the implant (unverified by Trezor): an extra circuit board between the main board and the screen, with a cellular modem and antenna. Do not open the device or enter a phrase into it to check.","fix":"If a wallet came from CryptoBilis: create a new wallet on a device bought directly from Trezor or Ledger or from an authorised reseller, with a new recovery phrase, and move all funds there now. Never reuse the old phrase on any device. Do not set up CryptoBilis devices that are still unused. Contact Trezor or Ledger support for a replacement. For corporate treasury, buy hardware wallets only direct from the vendor and record where each one came from.","status":"open","published_at":null,"first_seen_at":"2026-10-30T12:35:31+00:00","triaged_at":"2026-10-30T12:35:31+00:00","updated_at":"2026-10-30T12:35:31+00:00","category":"vendor","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-202610':22A '2026':136B,162B,218B '28':138B '30':164B '4.8':124B '5':9A,32A,36A,154B '60':121B '9':134B 'affect':233B 'antenna':76B 'anyon':201B 'asian':49B 'august':161B 'behind':221B 'board':63B,67B 'bought':155B,209B 'btc':122B 'buyer':184B 'by':27A 'campaign':38B 'carri':11A 'cellular':14A,73B 'chainalysi':126B 'check':190B 'circuit':62B 'cmp':21A 'confirm':110B 'credibl':173B 'crypto':203B 'cryptobili':6A,46B,106B,113B,129B,157B,193B,211B 'cryptobilis':29A,33A 'custom':141B 'devic':103B,114B,179B 'donjon':96B 'drop':128B 'earli':40B 'early-warn':39B 'everi':109B 'examin':177B 'extra':61B 'first':100B 'found':53B,98B,196B 'four':191B 'hardwar':1A,42B 'hardware':24A 'hardware-wallets-sold-by-reseller-cryptobilis-trezor-safe':23A 'hidden':13A,56B 'hold':202B 'implant':15A,57B,149B 'indonesia':143B 'involv':112B 'kind':147B 'ledger':10A,37A,94B,102B,107B,208B 'loss':188B 'lost':118B 'lte':93B 'm':125B 'main':66B 'march':217B 'mobil':91B 'modul':74B 'network':92B 'number':230B 'oct':135B,139B,165B 'one':116B 'phrase':20A,81B 'purchas':215B 'read':78B 'recoveri':19A,80B 'report':144B,171B,186B 'resel':5A,50B,132B 'reseller':28A 'risk':200B 'safe':8A,31A,35A,153B 'said':167B 'say':108B 'screen':70B,84B 'send':86B 'sinc':216B 'sold':3A,26A,44B,104B 'southeast':48B 'steal':17A 'tamper':198B 'team':97B 'theft':111B 'tokopedia':159B 'total':229B 'treat':169B 'trezor':7A,30A,34A,127B,152B,166B,183B,189B,206B,212B 'unit':194B,232B 'unknown':224B 'victim':117B 'wallet':2A,43B 'wallets':25A 'warn':41B,213B 'yet':180B","nicknames":["CryptoBilis"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"first_public_at":"2026-10-30T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202610-hardware-wallets-sold-by-reseller-cryptobilis-trezor-safe-5-","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-30T12:35:31+00:00","fetched_at":"2026-10-30T12:35:31+00:00","note":null}],"documents":[{"id":23313,"url":"https://x.com/TheHackersNews/status/2116143615856853476","title":"@TheHackersNews: ‼️WARNING - A Trezor Safe 5 wallet reportedly contained a hidden cellular implan","kind":"post","source":"x","publisher":null,"text":"‼️WARNING - A Trezor Safe 5 wallet reportedly contained a hidden cellular implant designed to transmit users' recovery phrases.\n\nTrezor is now urging everyone who bought a wallet supplied by CryptoBilis since March 2026 to move their funds to a new wallet with a new recovery https://t.co/9dXkMS29Pe\n\nlikes 119 reposts 41","published_at":"2026-10-30T12:22:08+00:00","relation":"describes","confidence":null,"note":null},{"id":23445,"url":"https://decrypt.co/382216/trezor-warns-cryptobilis-buyers-after-report-of-hardware-implant-in-safe-5","title":"Trezor Warns CryptoBilis Buyers After Report of Hardware Implant in Safe 5 (Decrypt)","kind":"blog","source":"analyst","publisher":null,"text":"Trezor (blog + X, 30 Oct 2026): responsible disclosure received 28 Oct of a hardware implant in a Trezor Safe 5 bought from reseller CryptoBilis via Tokopedia (Indonesia) in August 2026. Reported: extra circuit board between main board and screen with cellular module and antenna; reads the screen including the wallet backup and sends it over a mobile network when plugged in. Trezor has not yet examined the device but treats it as credible (customer description + video call). No CryptoBilis buyer has reported a loss to Trezor. Advice: anyone who bought a Trezor from CryptoBilis since March 2026 should move funds to a new wallet with a new recovery phrase, never reuse the old phrase, not use unset-up devices, contact Trezor Support for replacement. Trezor removed CryptoBilis as reseller on 9 Oct after Ledger investigated losses; Trezor inspected four CryptoBilis units (Safe 7, two Safe 5, Safe 3) and found no tampering. Ledger Donjon found an implant in Ledger devices sold via CryptoBilis that reads the 24-word phrase from the screen during setup and exfiltrates over LTE; all confirmed Ledger losses involve CryptoBilis devices; Ledger asked resellers in seven Asian markets to pull devices; one victim lost >60 BTC (~.8M, Chainalysis). Who is behind it: unknown.","published_at":"2026-10-30T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}