Trezor has told anyone who bought a wallet from the reseller CryptoBilis since March 2026 to move funds to a new device with a new recovery phrase, after a customer in Indonesia opened his Safe 5 and found hardware that does not belong there.
The extra board sits between the main board and the screen, carries a cellular module and an antenna, reads the display, and transmits the wallet backup whenever the device has power. The buyer got it in August through Tokopedia and reported it October 28.
Trezor has not examined the device. It has the photos, has interviewed the owner over video, and is arranging shipment to its lab. Waiting for that confirmation, it said, would leave other CryptoBilis buyers exposed meanwhile.
The response is blunt because a tampered device defeats the obvious fix: restoring an old phrase onto clean hardware does not help if the compromised wallet already broadcast it. Owners without a second hardware wallet should park funds in a software wallet or trusted exchange for now. Anyone who has not set the device up should leave it sealed and never type an existing phrase in.
Trezor dropped CryptoBilis as its Southeast Asia distributor on October 9, after Ledger began investigating losses among customers who bought through the same reseller. Ledger has since confirmed one affected wallet held an implant built to capture the phrase during setup. Singapore police issued a separate advisory on October 28 covering tampered Ledger units sold in local stores, with at least two cases since September 10.
Owners cannot screen a device by hand, and Trezor warns against weighing or opening one. The Safe 5 buyer noticed a weight difference, but small variances have innocent explanations. Trezor also expects phishing to follow, through fake emails, letters and calls offering replacements.
