Trezor reveals Malaysian reseller sold wallet with spyware

What it is

Trezor says it has seen a Safe 5 hardware wallet, bought in August 2026 from its official Malaysian reseller CryptoBilis, with a physical spyware implant inside. The source is a user report that Trezor has not yet verified. Danny Sanders, Trezor's Chief Commercial Officer, said: "We haven't had the device in our lab yet, but we're treating the report as credible."

How it works

Per Trezor, an extra circuit board sits between the main board and the screen, with a cellular module and an antenna. The user report says it "reads what the screen shows, including the wallet backup, and sends it out over a mobile network whenever the device is plugged in." Protos says this resembles the earlier spyware found in Ledger devices. The page gives no teardown detail beyond this.

Preconditions / Affected

Affected buyers are those who bought a Trezor from CryptoBilis since March 2026. The implant sends data only when the device is plugged in. Trezor checked four other CryptoBilis-sourced wallets and "found no evidence of tampering."

What to do

Trezor tells CryptoBilis buyers from March 2026 onward to move their funds out of the wallet and contact Trezor, which will send a replacement. Because the reported implant captures the screen, including the backup, a seed shown on a suspect device should be treated as exposed. That inference is not stated on the page.

Caveats

• Trezor has not examined the device, and the single report is unverified.
• Trezor says no funds have been reported stolen.
• Trezor dropped CryptoBilis as a reseller on 9 October 2026, after an $86 million Ledger wallet hack that used spyware in wallets CryptoBilis sold.
• Trezor said then that "There is not a single piece of evidence that Trezor devices have been compromised."
• Trezor is reviewing its other Asia-based resellers. Ledger has dropped official resellers in Malaysia, Indonesia, Singapore, Thailand, the Philippines, Vietnam and Hong Kong.