Tampered hardware from a reseller: an implant reported in a Trezor, after Ledger
A sealed box, a new device, an “official” reseller. And yet, inside, one circuit board too many, with a cellular module and an antenna. That’s what an Indonesian customer says he found in a Trezor Safe 5 cryptocurrency wallet bought in August 2026 from the reseller CryptoBilis.
Trezor published a warning on October 30, 2026. A few weeks earlier, Ledger had confirmed tampered devices sold by the same reseller. Even if your SMB holds no cryptocurrency, this story touches a sensitive point: hardware that is compromised before it even reaches you.
Tampered hardware from a reseller: what was reported
Step 1
factory
Manufacturer
Trezor or Ledger builds and seals the device.
Step 2
reseller
CryptoBilis
Authorized reseller in Southeast Asia until October 2026.
Step 3
marketplace
Online store
Device sold, among others, on Tokopedia.
Step 4
customer
The buyer
Receives a device that looks new… with an added board.
According to the report Trezor received, the added board sat between the main board and the screen. It reportedly reads what is displayed, including the recovery phrase (the wallet’s master key), then sends it over the cellular network whenever the device is plugged in. At Ledger, the confirmed principle is the same: capture the recovery phrase during setup and transmit it over a mobile network.
What we know, and what we don’t know yet
✔️ Confirmed
- Ledger confirmed physically tampered devices sold by CryptoBilis, in a supply chain attack.
- Trezor removed CryptoBilis as a reseller on October 9, 2026 and limited its authorized sellers.
- A customer reported the implant on October 28, 2026. Trezor considers the report credible.
- No CryptoBilis buyer has reported a loss of funds to Trezor.
❓ Not confirmed yet
- Trezor has not yet examined the device in its own lab.
- Who is behind the attack is unknown, as is whether it is the same group as with Ledger.
- No other reseller or region is involved so far.
- Weighing or opening the device is not conclusive, according to Trezor.
⚠️ Bought a Trezor from CryptoBilis since March 2026?
Move your funds to a new wallet with a new recovery phrase as soon as possible. If the device isn’t set up yet, don’t set it up and never enter an existing phrase on it. Trezor offers a replacement: keep the device and contact its support. Watch out for fake emails, calls and letters exploiting the incident.
Why an SMB without cryptocurrency should care
The same scenario can target any device that protects your access: physical security keys (YubiKey), firewalls, routers, admin laptops, encrypted USB drives. A device bought at the lowest price on a marketplace, from a third-party seller, or received “already configured” by someone else is a risk. The attacker doesn’t need to hack your network: they sell you the way in.
We covered this with the compromised admin laptop at Binance: the computers and devices that hold the keys deserve special treatment, starting at purchase.
The receiving rule for security hardware
Post it at receiving
5 rules before plugging in a security device
- Buy only from the manufacturer or a reseller listed on its official website.
- Refuse any device delivered with a password, PIN or recovery phrase already provided.
- Check the seal, the serial number and authenticity with the manufacturer’s tool, if it offers one.
- Initialize the device yourself and update its firmware from the official source.
- Record in the inventory: supplier, date, serial number and who configured it.
When in doubt, don’t plug it in: call the manufacturer or your IT provider.
How NeoTech can help
Our cybersecurity services include buying hardware through authorized channels, configuring firewalls, laptops and security keys, and keeping an up-to-date inventory of your devices. Our automated 24/7 monitoring with on-call technician intervention spots unknown devices and unusual communications on your network.
Book your free cyber check
In 30 minutes, we look together at where your security hardware comes from, who configured it and how you receive it.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Our office: 2572 boul. Daniel-Johnson, office 237, Laval.
Sources
- Trezor — Implant reported in a Trezor sold by CryptoBilis, October 30, 2026
- Ledger — Ledger’s Response to the Hardware Implant Attack
- The Hacker News — Trezor Warns of Suspected Hardware Implant in One of Its Wallets Sold by CryptoBilis, October 2026
- Decrypt — Trezor Cuts Its Resellers After Ledger Finds Spy Implant in Crypto Wallets
Photo: Joachim Schnürle, Pexels (Pexels licence).