Crypto Security: After Ledger, Trezor Flags an Implant at CryptoBilis

On October 30, 2026, Trezor asked buyers of its wallets purchased from the retailer CryptoBilis since March 2026 to move their crypto assets to a new wallet. This alert follows the reporting of a hardware implant in a Safe 5, according to Trezor’s blog post. The manufacturer has not yet received the device, and no buyer has reported any loss at this stage.

Signaled on October 28 by a customer in Indonesia, the crypto implant triggered Trezor’s alert two days later

The customer submitted their report via the responsible disclosure program of Trezor. They had purchased their Safe 5 in August 2026 from CryptoBilis, on the Tokopedia platform. Trezor thus relies on the customer’s description as well as a video interview.

According to the manufacturer, waiting for laboratory confirmation would leave CryptoBilis buyers exposed. However, Trezor does not specify who is behind the crypto implant.

The report describes an additional card, equipped with a cellular module and an antenna. The card reads what is displayed on the screen, including the crypto wallet backup. It then sends it via mobile network as soon as the device is plugged in.

This backup is none other than the recovery phrase, the list of words that allows restoring a wallet on any device. Anyone who holds it can therefore move the crypto funds without touching the original device.

At Ledger, a similarly operating implant has been confirmed since October 10

Ledger confirmed on October 10 an implant in a device sold by CryptoBilis. Its Donjon team described on October 13 a separate component that reads the 24-word phrase displayed during setup. It then transmits it via LTE thanks to an eSIM. According to Ledger, the crypto implant does not modify either the secure element or the device’s system.

The onchain investigator Specter estimates the suspicious thefts to be over 86 million dollars on Ethereum, Tron, and Bitcoin. The media outlet Yfarmx advances, for its part, 103 million dollars. Ledger has not yet confirmed a total.

According to Trezor, the reported crypto implant seems to operate similarly without wanting to draw comparisons during the investigation. The manufacturer had removed CryptoBilis from its reseller list on October 9, 21 days before the alert. It then inspected four devices purchased from this reseller without finding any trace of tampering:

• a Safe 7;
• two Safe 5s;
• a Safe 3.

Trezor asks to transfer crypto funds to a new wallet with a new phrase

CryptoBilis buyers since March 2026 must create a new crypto wallet with a new recovery phrase. They must also move their funds there as soon as possible. It is important not to reuse the old phrase on any device. Furthermore, avoid using an unconfigured device. Customers can, however, keep the device and contact support for a replacement.

At this stage, no source specifies if CryptoBilis ships to Europe. No deadline has also been announced before laboratory analysis.

Trezor counts one reported implant, against four devices inspected without tampering. At Ledger, the secure element remains intact according to Donjon. If this pattern is confirmed, the crypto flaw is located between the factory and the buyer. The origin of the device then becomes a security criterion. Story to follow…