Inside the CryptoBilis Hardware Implant: How Attackers Turned Trusted Crypto Wallets Into Cellular Spies
In October 2026, Trezor issued an urgent warning after a customer in Indonesia reported discovering an unauthorized circuit board inside a Trezor Safe 5 hardware wallet purchased from authorized Southeast Asian reseller CryptoBilis via the Tokopedia marketplace. The implanted board, positioned between the device's main board and screen, contained a cellular module and antenna capable of reading and transmitting the wallet's recovery phrase over a mobile network whenever the device was powered. Trezor revoked CryptoBilis's reseller status on October 9 and advised all buyers since March 2026 to immediately transfer funds to a newly seeded wallet, as restoring the old seed phrase on a clean device provides no protection if the phrase was already exfiltrated. This incident follows a parallel hardware-implant discovery in Ledger wallets sourced from the same reseller, prompting a Singapore Police advisory and active criminal investigations. This supply-chain hardware implant attack represents a critical escalation in cryptocurrency theft tactics, moving beyond software exploits and phishing to physical interdiction of trusted devices before they reach end users. With multiple wallet brands and retail channels implicated across Southeast Asia, the campaign signals a sophisticated, organized threat actor willing to invest in hardware-level compromise—a trend that raises the security bar for any organization relying on hardware roots of trust.
Kill Chain
