---
id: "CMP-202610-hardware-wallets-sold-by-reseller-cryptobilis-trezor-safe-5-"
kind: "campaign"
aliases: []
title: "Hardware wallets sold by reseller CryptoBilis (Trezor Safe 5, Ledger) carry a hidden cellular implant that steals the recovery phrase"
severity: "high"
cvss: null
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Trezor Safe 5", "fixed": [], "affected": "units bought from reseller CryptoBilis since March 2026", "ecosystem": "hardware"}, {"name": "Ledger", "fixed": [], "affected": "hardware wallets bought from reseller CryptoBilis", "ecosystem": "hardware"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-10-30T12:35:31+00:00"
updated_at: "2026-10-30T12:35:31+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-30T12:35:31+00:00"}]
---

# Hardware wallets sold by reseller CryptoBilis (Trezor Safe 5, Ledger) carry a hidden cellular implant that steals the recovery phrase

Hardware wallets sold through CryptoBilis, a Southeast Asian reseller, have been found with a hidden implant. It is an extra circuit board between the main board and the screen, with a cellular module and antenna. It reads the recovery phrase off the screen and sends it out over the mobile network (LTE). Ledger's Donjon team found it first in Ledger devices sold by CryptoBilis. Ledger says every confirmed theft involves CryptoBilis devices, and one victim lost more than 60 BTC (about $4.8M, Chainalysis). Trezor dropped CryptoBilis as a reseller on 9 Oct 2026. On 28 Oct a customer in Indonesia reported the same kind of implant in a Trezor Safe 5 bought from CryptoBilis on Tokopedia in August 2026. On 30 Oct Trezor said it treats the report as credible but has not examined the device yet, and no Trezor buyer has reported a loss. Trezor checked four other CryptoBilis units and found no tampering. At risk: anyone holding crypto on a Trezor or Ledger bought from CryptoBilis (Trezor warns about purchases since March 2026). Who is behind it is unknown, and so is the total number of units affected.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- hardware:Trezor Safe 5 affected units bought from reseller CryptoBilis since March 2026 fixed ?
- hardware:Ledger affected hardware wallets bought from reseller CryptoBilis fixed ?

## How to check

Check where each hardware wallet (Trezor, Ledger) was bought. Treat any unit bought from CryptoBilis, including through Tokopedia or other marketplaces, since March 2026 as compromised. Signs of the implant (unverified by Trezor): an extra circuit board between the main board and the screen, with a cellular modem and antenna. Do not open the device or enter a phrase into it to check.

## Fix

If a wallet came from CryptoBilis: create a new wallet on a device bought directly from Trezor or Ledger or from an authorised reseller, with a new recovery phrase, and move all funds there now. Never reuse the old phrase on any device. Do not set up CryptoBilis devices that are still unused. Contact Trezor or Ledger support for a replacement. For corporate treasury, buy hardware wallets only direct from the vendor and record where each one came from.

## Timeline

- 2026-10-30T12:35:31+00:00 analyst

## Documents

- [describes] @TheHackersNews: ‼️WARNING - A Trezor Safe 5 wallet reportedly contained a hidden cellular implan https://x.com/TheHackersNews/status/2116143615856853476
- [describes] Trezor Warns CryptoBilis Buyers After Report of Hardware Implant in Safe 5 (Decrypt) https://decrypt.co/382216/trezor-warns-cryptobilis-buyers-after-report-of-hardware-implant-in-safe-5

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_