> ## Content Index
> Fetch the complete content index at: https://blog.harshkohli.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Trezor Warns of Spy Implant in Reseller Wallets
- URL: https://blog.harshkohli.com/trezor-cryptobilis-implant-warning/
- Published: 2026-10-30T13:05:52.000Z
- Updated: 2026-10-30T13:05:52.000Z
- Description: A Trezor Safe 5 sold by reseller CryptoBilis had a hidden cellular board. Bought from them? Move your crypto to a new wallet and seed now.
- Author: Harsh Kohli
- Tags: Tech News, Software

Bought a Trezor from CryptoBilis? Move your crypto to a new wallet now. That's Trezor's advice after a buyer in Indonesia opened up a Trezor Safe 5 and found an extra board with a cellular radio stuck inside. The buyer thinks it reads your recovery words off the screen and sends them out. Not great.

## What happened

According to [Trezor's own security notice](https://trezor.io/blog/news/implant-reported-in-a-trezor-sold-by-cryptobilis?ref=blog.harshkohli.com), the customer reported the problem on October 28 through its responsible disclosure process. They had bought the Safe 5 in August from CryptoBilis, an authorised reseller that sold through the Tokopedia marketplace. When they opened it, there was an extra circuit board squeezed between the main board and the display, with a cellular module and an antenna attached.

The customer says the board can capture what's shown on screen, including the wallet backup, and send it out whenever the device is plugged in. Trezor hasn't confirmed that yet. The device is on its way to Trezor's lab, and the company says it doesn't know of any lost funds. The person who found it had already moved their coins. I first saw this through [The Hacker News on X](https://x.com/TheHackersNews/status/2116143615856853476?ref=blog.harshkohli.com), and [its write-up](https://thehackernews.com/2026/10/trezor-warns-of-suspected-hardware.html?ref=blog.harshkohli.com) adds useful background.

This isn't the first warning about CryptoBilis. Trezor dropped the seller on October 9 after Ledger looked into customer losses and found tampered Ledger devices too. On October 28, Singapore Police also warned that Ledger wallets bought from some retail stores there had malicious parts inside, with at least two cases since September 10.

## Why it matters

The whole point of a hardware wallet is that you can trust the box. If the box is lying, you're done. Your recovery phrase is basically the key to every coin you own, and once it leaks, whoever has it can restore your wallet anywhere. So no, putting the same 24 words into a new Trezor won't help. Those words are burned, and you need new ones.

It also shows how much the seller matters. So far nobody has reported other resellers, but buying direct from the maker, or from a shop you really trust, is the safer habit.

## What to do

- If you bought any Trezor model from CryptoBilis since March 2026, set up a brand-new wallet with a brand-new recovery phrase and move everything to it. A software wallet or exchange is fine as a stopgap.
- If the device is still unused, don't set it up, and never type an existing backup into it.
- Don't open it or try to check it yourself. Keep it and contact Trezor Support, since affected buyers can get a free replacement or a voucher.
- Expect phishing. Scammers will likely send fake emails, letters and calls about this. Never share your recovery phrase with anyone.

If you hold crypto on exchanges too, my post on the [suspected Binance hack](https://blog.harshkohli.com/binance-hack-withdrawals-paused/) covers what to watch for there.