Affected Systems

All Trezor hardware wallet models purchased from reseller CryptoBilis or its marketplace stores (including Tokopedia) since March 2026. Confirmed implant found in Trezor Safe 5; other models from same reseller considered at risk. Geographic focus: Southeast Asia, particularly Indonesia. Ledger devices from CryptoBilis also affected per separate investigation.

Exploitation Status

Active supply chain compromise confirmed. At least one Trezor Safe 5 device verified to contain a physical hardware implant (extra circuit board with cellular module) that intercepts and exfiltrates recovery phrases over mobile networks when device is powered. Ledger reported similar implants in devices from same reseller. No confirmed fund losses reported to Trezor as of October 30, 2026, but Singapore Police confirmed at least two Ledger cases since September 10, 2026.

Business Impact

Cryptocurrency holders who initialized wallets using compromised devices have had their recovery phrases (seed phrases) exfiltrated, enabling complete wallet takeover and fund theft at any time. This is a physical supply chain interdiction attack affecting authorized reseller inventory. Trezor cannot detect which customers are affected or monitor fund movements. CryptoBilis was an authorized reseller until October 9, 2026, lending legitimacy to the compromised devices. Incident creates phishing opportunity as attackers may impersonate Trezor support. No CVE assigned (hardware supply chain attack, not software vulnerability).

Urgency

🔴 Immediate

Recommended Actions

  • Immediately identify any Trezor or Ledger hardware wallets purchased from CryptoBilis, its Tokopedia store, or other Southeast Asian resellers since March 2026 using purchase records.
  • Move all cryptocurrency funds from affected wallets to new wallets with freshly generated recovery phrases; do not reuse old recovery phrases on any device, as they are presumed compromised.
  • If no secure hardware wallet is available, temporarily move funds to a trusted software wallet or reputable exchange until a verified replacement device can be obtained.
  • Contact Trezor Support to arrange replacement device or voucher; retain the suspected compromised device for forensic analysis and do not attempt to disassemble it.
  • Alert cryptocurrency holders in your organization to verify device provenance and watch for phishing attempts impersonating Trezor or Ledger support related to this incident.

---

# Threat Actor Context

Actor Profile

The threat actor behind this supply chain interdiction campaign remains unattributed. The operation involves physical tampering of Trezor Safe 5 and Ledger hardware wallets sold through the reseller CryptoBilis in Southeast Asia. The actor's motivation is financial theft via exfiltration of cryptocurrency wallet recovery phrases. The implants demonstrate sophisticated hardware engineering capabilities, including custom circuit boards with cellular modules designed to intercept and transmit sensitive cryptographic material. The operation targets the cryptocurrency supply chain, specifically exploiting the trust relationship between hardware wallet manufacturers and authorized resellers. Similar implants have been discovered in Ledger devices from the same reseller, suggesting a coordinated campaign rather than isolated incidents.

TTPs (Tactics, Techniques, Procedures)

The primary technique is supply chain compromise (T1195.003 - Compromise Hardware Supply Chain) through interdiction of legitimate hardware wallets during distribution. The implant consists of a custom circuit board positioned between the device's main board and screen, incorporating a cellular module and antenna. The malicious hardware reads screen output (T1113 - Screen Capture) to capture recovery phrases during wallet setup or display. Data exfiltration occurs over mobile networks (T1041 - Exfiltration Over C2 Channel) whenever the device is powered on. The attack targets the initial access phase by compromising devices before they reach end users, requiring no software exploitation. The technique bypasses traditional security controls as the implant operates at the hardware layer, independent of the wallet's firmware integrity checks.

Targets & Patterns

The campaign specifically targets cryptocurrency holders in Southeast Asia, with confirmed victims in Indonesia and Singapore. The threat actor selected CryptoBilis, an authorized reseller serving the Southeast Asian market, as the interdiction point. Victims purchased devices through both direct channels and third-party marketplaces like Tokopedia between March 2026 and October 2026. The targeting pattern suggests the actor chose a regional reseller to maximize impact while minimizing detection risk compared to compromising manufacturer facilities. Both Trezor and Ledger customers who purchased from CryptoBilis are affected, indicating the actor targeted the reseller's entire supply chain rather than a specific wallet brand. The cryptocurrency sector remains attractive due to the irreversible nature of blockchain transactions and the high-value assets stored on hardware wallets.

Historical Context

This campaign represents an escalation in hardware wallet supply chain attacks. Trezor terminated its relationship with CryptoBilis on October 9, 2026, after Ledger began investigating customer losses linked to the same reseller. Ledger subsequently confirmed unauthorized hardware implants in devices sold by CryptoBilis, with similar functionality to the Trezor Safe 5 implant. The Singapore Police Force issued an advisory on October 28, 2026, noting at least two reported cases since September 10, 2026. The coordinated nature of implants across multiple hardware wallet brands from a single reseller suggests a sustained operation spanning at least seven months (March-October 2026). This represents a sophisticated evolution from software-based cryptocurrency theft to physical supply chain interdiction, requiring significantly greater resources and operational security.

Defensive Recommendations

  • Implement hardware authentication mechanisms such as holographic seals, tamper-evident packaging, and device-specific cryptographic attestation that can be verified before first use
  • Establish direct manufacturer purchase channels and verify reseller authorization status through official manufacturer websites before purchasing hardware wallets or other security-critical devices
  • Conduct physical inspection of hardware wallets upon receipt, comparing weight, dimensions, and external characteristics against manufacturer specifications before initialization
  • Monitor for unauthorized cellular or radio frequency emissions from hardware security devices using RF detection equipment in controlled environments before storing sensitive credentials
  • Implement supply chain security controls (NIST SP 800-161) including vendor risk assessments, chain-of-custody documentation, and third-party hardware verification for security-critical components