Trezor said it has seen a report that one of its crypto wallets sold by official Malaysian reseller CryptoBilis contained a physical spyware implant. The affected device was a Trezor Safe 5 purchased in August this year.
Implant reportedly sat between the main board and screen
Trezor told Protos that the suspected implant involved an extra circuit board fitted between the main board and the screen, plus a cellular module and an antenna.
According to the user report, which Trezor said it has not yet thoroughly verified, the implant 「reads what the screen shows, including the wallet backup, and sends it out over a mobile network whenever the device is plugged in」. Protos said the setup resembles the way an earlier spyware device in Ledger wallets worked.
Trezor tells CryptoBilis buyers to move funds and seek replacements
Trezor said it will replace wallets sourced from CryptoBilis. Chief Commercial Officer Danny Sanders told Protos, 「We haven’t had the device in our lab yet, but we’re treating the report as credible, and we’d rather warn people now than wait for confirmation and find out someone lost their funds in the meantime.」
Buyers who purchased a wallet from CryptoBilis since March 2026 were told to move their funds out of the wallet and contact Trezor’s team for a replacement device.
In a post on X, Sanders wrote: 「If you bought a Trezor with the reseller CryptoBilis after March 2026, move your funds to a new wallet right now. We’ve received a report of 1 device with tampering. We believe this is a credible implant and we are acting fast on it. As of now, we have no reports of lost funds.」
Trezor also told Protos that it checked four other Trezor wallets sourced from CryptoBilis and 「found no evidence of tampering.」
CryptoBilis removed as official reseller
Trezor dropped CryptoBilis as one of its official resellers on October 9. Protos said the move came after an $86 million Ledger wallet hack that relied on spyware installed in wallets sold by CryptoBilis.
Trezor now says it is reviewing its other Asia-based resellers.
After that hack, Ledger cut ties with official resellers across Malaysia, Indonesia, Singapore, Thailand, the Philippines, Vietnam, and Hong Kong.
At the time of the Ledger wallet hack, Trezor said, 「There is not a single piece of evidence that Trezor devices have been compromised.」 In its latest statement, the company maintained that 「No funds have been reported as stolen.」
