Trezor: Hardware Wallets Sold by CryptoBilis Suspected of Containing Malicious Circuit Boards; Users Must Migrate Assets Immediately

According to TechFlow, on October 30, Trezor officially stated that its security team had received a responsible disclosure report stating that a Trezor Safe 5 hardware wallet purchased through CryptoBilis, an authorized reseller in Southeast Asia, was suspected of a supply chain attack and had been embedded with an additional circuit board, a cellular communication module, and an antenna, capable of reading information displayed on the device screen, including the wallet seed phrase, and transmitting it over the mobile network.

The device was purchased in August 2026 through the Indonesian e-commerce platform Tokopedia. Trezor has not yet received the device for laboratory testing, but based on the user-provided description and video interview, it considers the report credible. There have been no reports of user funds being stolen.

Trezor advised users who have purchased hardware wallets through CryptoBilis since March 2026 to migrate their assets as soon as possible to wallets created with new seed phrases, and not to directly import the original wallet backup into another device. Eligible users may apply for a replacement device or receive a device purchase voucher.

Source: TechFlow