Trezor says CryptoBilis wallet in Malaysia contained spyware implant

Trezor claims a hardware wallet sold by its official Malaysian reseller CryptoBilis contained a physical spyware implant.

The affected device, a Safe 5 model, was purchased from CryptoBilis in August 2026.

According to Trezor’s explanation to Protos, the tampering consists of an additional circuit board inserted between the motherboard and display, equipped with a cellular module and antenna. The implant, per an unverified user report, “reads what the screen shows, including the wallet backup, and sends it out over a mobile network whenever the device is plugged in.”

This approach mirrors the spyware element found previously in certain Ledger hardware.

Trezor will swap out devices bought from CryptoBilis

“We haven't had the device in our lab yet, but we're treating the report as credible, and we'd rather warn people now than wait for confirmation and find out someone lost their funds in the meantime,” stated Trezor Chief Commercial Officer Danny Sanders.

Anyone who bought a wallet from CryptoBilis from March 2026 onward has been advised to transfer their funds and get in touch with Trezor to receive a replacement device.

If you bought a Trezor with the reseller CryptoBilis after March 2026, move your funds to a new wallet right now.

We’ve received a report of 1 device with tampering. We believe this is a credible implant and we are acting fast on it. As of now, we have no reports of lost funds.

— Danny (@Dantoshi)

Four other Trezor wallets obtained from CryptoBilis were checked by the company, which told Protos it “found no evidence of tampering.”

Trezor might cut ties with other resellers going forward

On October 9, Trezor removed CryptoBilis from its roster of official resellers following an $86 million hack of Ledger wallets that used spyware delivered through devices sold by CryptoBilis.

The firm says it is currently reviewing its remaining resellers across Asia.

In the wake of the incident, Ledger also cut connections with official sellers in a number of Southeast Asian countries including Malaysia, Indonesia, Singapore, Thailand, the Philippines, Vietnam, and Hong Kong.

Following the Ledger hack, Trezor had stated, “There is not a single piece of evidence that Trezor devices have been compromised.”

The company reiterated in its latest report that “No funds have been reported as stolen.”