A Trezor Safe 5 hardware wallet bought from the reseller CryptoBilis has an extra circuit board that sends out the recovery phrase over a mobile network, a customer has reported.
Trezor has not yet examined the device. It is telling everyone who bought a Trezor from CryptoBilis since March 2026 to move their funds to a new wallet with a new recovery phrase.
Trezor said in a blog post on October 30 that the report came in two days earlier from a customer in Indonesia. He bought the wallet from CryptoBilis in August, through the marketplace Tokopedia.
The board sits between the wallet's main board and its screen, with a cellular module and an antenna, according to the report. It reads the screen, including the recovery phrase (Trezor calls it the wallet backup), and sends it out whenever the device is plugged in.
Trezor has the customer's photos and description and has interviewed him on a video call. It is arranging for the wallet to be sent to its lab.
Trezor finds the report believable enough to warn buyers now. "Waiting for lab confirmation would leave CryptoBilis buyers exposed in the meantime," the company said.
No CryptoBilis buyer has reported losing funds to Trezor, which cannot see what customers hold in their wallets. The customer had moved his funds off the wallet before he found the board.
Trezor's advice covers every Trezor model bought from CryptoBilis since March 2026, from any store that sold devices CryptoBilis supplied, including its store on Tokopedia:
Source link







