Trezor claims it has seen one of its crypto wallets sold by the official Malaysian-based reseller CryptoBilis containing a physical spyware implant.
The tampered wallet was Trezor’s ‘Safe 5’ model, and was bought from CryptoBilis in August this year.
Trezor told Protos that the implant involves an extra circuit board fitted between the main board and the screen, with a cellular module and an antenna.
According to the user report, which Trezor has yet to thoroughly verify, the implant “reads what the screen shows, including the wallet backup, and sends it out over a mobile network whenever the device is plugged in.”
This is similar to how the previous spyware device in Ledger devices functioned.
Trezor says it will replace CryptoBilis-sourced wallets
Trezor’s Chief Commercial Officer, Danny Sanders, claimed, “We haven’t had the device in our lab yet, but we’re treating the report as credible, and we’d rather warn people now than wait for confirmation and find out someone lost their funds in the meantime.”
Buyers who purchased a wallet from CryptoBilis since March 2026 were told to move their funds out of their wallet and contact Trezor’s team, who will provide a replacement wallet.
Read more: Trezor says mailing breach leaked 67K more users than first thought
Trezor also told Protos that it has checked four other CryptoBilis-sourced Trezor wallets and “found no evidence of tampering.”
Trezor may drop more resellers in the future
Trezor dropped CryptoBilis as one of its official resellers on October 9 in the wake of an $86 million Ledger wallet hack that relied on spyware installed in CryptoBilis-sold wallets.
It now claims that it is reviewing its other Asia-based resellers.
Following the hack, Ledger dropped ties with official resellers across Malaysia, Indonesia, Singapore, Thailand, the Philippines, Vietnam, and Hong Kong.
Read more: Trezor’s summer of hacks continues with Brevo email breach
At the time of the Ledger wallet hack, Trezor claimed, “There is not a single piece of evidence that Trezor devices have been compromised.”
It maintained in today’s report that “No funds have been reported as stolen.”
Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.