-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0293
============================================================

Advisory-ID:  0xCERT-2026-0293
Severity:     High
Published:    2026-10-30T00:00:00.000Z
Updated:      2026-10-31T16:42:37.250Z
Chains:       Other / Multi-chain
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0293

Title: Trezor warns CryptoBilis buyers after reported hardware implant in Safe 5 that may exfiltrate wallet backups

Summary
- -------
Trezor received a credible, not yet lab-verified report of a cellular hardware implant in a Trezor Safe 5 bought from former reseller CryptoBilis. Anyone who bought a Trezor from CryptoBilis since March 2026 should move funds to a new wallet with a new seed.

Details
- -------
Summary
On October 30, 2026 Trezor published a notice about a responsible-disclosure report (received October 28) of a hardware implant in a Trezor Safe 5 bought from CryptoBilis, until October 2026 an official Trezor reseller in Southeast Asia. The device was bought in August 2026 via Tokopedia by a customer in Indonesia. Trezor has not yet examined the device but treats the report as credible and says the implant appears to operate similarly to those seen in tampered Ledger devices sold by the same reseller.

Affected
- - Any Trezor hardware wallet purchased from CryptoBilis from March 2026 onwards
- - No fix available: affected devices should be retired, not reused

Impact
Per the report (not yet verified by Trezor), an extra circuit board with a cellular module and antenna is fitted between the main board and the screen; it reads what the screen shows, including the wallet backup (recovery phrase), and transmits it over a mobile network whenever the device is plugged in. A wallet created on such a device must be treated as compromised. Trezor states it has no evidence that any customer has lost funds, and no CryptoBilis buyer has reported a loss to it. Exploitation in the wild is not confirmed.

Recommended actions
- - If you bought a Trezor from CryptoBilis from March 2026 onwards and hold funds on it: move funds to a newly created wallet with a new seed as soon as possible; restoring the existing backup on another device does not solve the issue
- - If the device is not set up yet: do not set it up and never enter an existing wallet backup on it
- - Do not open the device to inspect it yourself; keep it and contact Trezor Support for a replacement device or voucher
- - Expect follow-on phishing (fake emails, letters, calls); never share a recovery phrase — Trezor Support will never ask for it

Source & attribution
This 0xCERT advisory summarises a disclosure by Trezor (report received via its responsible disclosure program from a customer in Indonesia; SEAL 911 assisted): https://trezor.io/blog/news/implant-reported-in-a-trezor-sold-by-cryptobilis. Details may change; refer to the original source for the authoritative record.

References
- ----------
- - https://trezor.io/blog/news/implant-reported-in-a-trezor-sold-by-cryptobilis
- - https://www.theblock.co/news/ecosystems/2026-10-30-trezor-reports-suspected-hardware-implant-432196
- - https://www.0xcert.com/advisory/0xCERT-2026-0232

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmroI20JEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmeyuslFh9lBI5Dyxmg8Ve0v7k5swujcFAhSCKo+
R0kpJRYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAADATQD+O1N62/iiJgQV6JOw
Qci6h/jtVoh5+xqgjp0VEG6onH8BAIz8lsnuJwLbQXCoKQ3mOuqUiNB4n18h
cVPUhh+NOaUE
=sYg7
-----END PGP SIGNATURE-----