TronscannerTrezor, Ledger and CryptoBilis: why a cold wallet is no guarantee of security
On October 30, 2026, Trezor warned of a possible spy implant in a Trezor Safe 5 hardware wallet bought from the reseller CryptoBilis. This is the second such case in a month: in early October, Ledger confirmed implants in its own devices sold by the same reseller. In neither case were the manufacturers themselves breached — the devices were tampered with on their way to the buyer. Both stories are a reminder that a cold wallet alone does not guarantee safe storage.
Information is current as of October 30, 2026.
The Trezor case: a possible implant in Safe 5
On October 28, Trezor received a report from a customer in Indonesia and published a warning on October 30. The Trezor Safe 5 was bought in August 2026 from CryptoBilis's store on the Tokopedia marketplace.
What was found. According to the owner, an extra circuit board with a cellular module and antenna had been installed between the main board and the screen. It allegedly read what the screen displayed, including the recovery phrase, and sent it over a mobile network whenever the device was plugged in.
Status. Trezor has not yet examined the device itself, but considers the report credible based on photos and a video interview. No funds were stolen: the owner moved their assets before discovering the implant. Trezor has received no similar reports involving other resellers. CryptoBilis was removed from Trezor's authorized resellers on October 9. Trezor is investigating together with Ledger, in consultation with SEAL 911.
Trezor's recommendations for anyone who bought a device from CryptoBilis since March 2026:
move funds to a new wallet with a new recovery phrase as soon as possible — restoring the old phrase on another device does not solve the problem;
do not set up an unactivated device or enter an existing phrase into it;
do not open or weigh the device: this gives no reliable result;
contact Trezor Support for a replacement;
beware of phishing: support will never ask for your recovery phrase.
A reminder: the recent Ledger case
The Trezor story is not the first. On October 9, 2026, Ledger opened an investigation into missing funds among customers who bought devices from CryptoBilis, an authorized reseller in Indonesia, Malaysia and the Philippines. The company soon confirmed an unauthorized hardware implant.
How the implant worked. According to Ledger Donjon, the extra component captured the 24-word recovery phrase during initial setup and sent it over LTE via a built-in eSIM. The secure chip and firmware were left untouched, so a standard authenticity check might not have detected the tampering.
Losses. Ledger has not confirmed a final figure. Independent estimates:
Source | Estimate |
|---|---|
Bitquery | about $93.2 million from 315 wallets across six blockchains |
Analyst Specter | over $86 million on Bitcoin, Ethereum and Tron |
Analyst tanuki42 | over $72 million sent to suspicious addresses |
Ledger said its infrastructure was not affected and that it had received no complaints from customers who bought directly from the manufacturer. CryptoBilis was asked to suspend sales. Tether froze $10 million in USDT at linked addresses.
Conclusion: a cold wallet does not guarantee safe storage
Hardware wallets remain one of the more reliable ways to store crypto. But their protection only works under certain conditions, and not all of them are in the user's hands.
The supply chain. A device can be altered anywhere between the factory and the buyer. In the CryptoBilis case, the seller was an authorized distributor for both brands.
Authenticity checks don't see everything. The implants left the secure chip alone and read data from the screen instead. A firmware check does not detect this kind of tampering.
The recovery phrase is a single point of failure. Whoever knows the 24 words controls the funds, no matter how secure the device is.
Attacks are getting more sophisticated. A cellular module hidden inside the case is no longer a phishing email — it is a well-prepared hardware attack.
Neither an exchange nor a hardware wallet offers absolute protection. Security comes from a reliable tool combined with the right habits.
How to protect your assets
Buy from the manufacturer. The official website is more reliable than marketplaces and intermediaries.
Generate your recovery phrase yourself. Never use a phrase that came with the device or was created in advance.
Keep the phrase offline. No screenshots, no email or cloud storage, and never share it with "support".
Check the full address before every transaction.
Spread your funds. Don't keep all your assets in one place — neither on an exchange nor on a single device.
Follow the news. If you bought a device from CryptoBilis, follow the official guidance from Ledger and Trezor.
If you want a cold wallet, you don't have to buy a separate device: Ironwallet can be used for cold storage. We have already explained how it works.
Ironwallet is built for people who want full control over their assets. Make the right choice for storage — download Ironwallet.
