Developing story, last reviewed 6 November 2026. Trezor hadn't examined the reported device when this was written, so details may change. Ryder makes a competing hardware wallet, so weigh this accordingly.
If you searched "trezor hack" this week, the short answer is that nothing reported so far points to a flaw in Trezor's firmware or a break-in at Trezor itself. What has been reported is narrower: on 28 October a customer in Indonesia said they'd found an extra circuit board hidden inside a Trezor Safe 5 bought from CryptoBilis, a former official reseller in Southeast Asia, and Trezor now tells anyone who bought a Trezor from CryptoBilis since March 2026 to move their funds to a new wallet. If your device came from somewhere else, Trezor says it has no reports involving other resellers or regions.
What Trezor has said about the Trezor hack report
Trezor published its notice on 30 October. The report reached its responsible disclosure program two days earlier from a customer who had bought the Safe 5 in August through CryptoBilis's shop on Tokopedia, a large Indonesian marketplace. According to the customer, the board sat between the main board and the screen with a cellular module and an antenna, and it read whatever the screen displayed, including the wallet backup, then sent that over a mobile network whenever the wallet was plugged in.
Trezor is careful about how much of this it can vouch for. It hadn't received the device when it published, so the description is the customer's own, which Trezor treats as credible based on that account and a video interview. Decrypt reported that Trezor had inspected four other devices bought from CryptoBilis (a Safe 7, two Safe 5s and a Safe 3) and found no evidence of tampering. No CryptoBilis buyer has reported a loss to Trezor, and the customer who found the board had already moved their funds off it.
Why Trezor warned before confirming
Trezor's reasoning, as it told Decrypt, was that "waiting for lab confirmation would leave CryptoBilis buyers exposed in the meantime." The Ledger case explains the urgency. Ledger owners in Southeast Asia began reporting drained wallets on 9 October, Ledger later confirmed physically tampered devices, and Help Net Security reports that every confirmed case involved a device sold by CryptoBilis. Bitquery's on-chain investigation puts the losses at 92.9 million USD taken from 311 wallets. Trezor dropped CryptoBilis on 9 October, the day Ledger's investigation began, and has since cut the number of sellers it works with.
A second thread points the same way, though it hasn't been tied to CryptoBilis. On 28 October the Singapore Police Force said preliminary investigations had found malicious hardware components in Ledger wallets bought from some retail stores in Singapore, and Cointelegraph reports at least two cases since 10 September with about 3.5 million Singapore dollars lost. Police didn't name the stores or say where the devices were supplied from. We cover the Ledger side in what the investigation has established and in our explainer on the Ledger implant research.
How to tell whether this affects you
Where your device came from decides it. Look up the seller name on your receipt or order history, and if it was CryptoBilis, or any store selling stock CryptoBilis supplied (its Tokopedia shop included), Trezor's guidance covers every Trezor model bought from March 2026 onward. A device bought from trezor.io or from another seller isn't covered by the warning, since Trezor says it has no reports involving other resellers or regions. If you can't work out where yours came from, Trezor Support can help you check.
What Trezor tells CryptoBilis buyers to do
Anyone holding funds on a CryptoBilis-bought Trezor should move them to a newly created wallet with a new recovery phrase as soon as possible. Restoring your old backup on a different device won't help, because the words themselves may have been read during setup. If you don't have another hardware wallet, Trezor suggests a software wallet or an exchange you already use as a temporary home, and it asks you to check the full receiving address before you send anything.
For a device that's still in its box, the advice is to leave it unset and never type an existing recovery phrase into it. Keep the unit rather than throwing it away, because Trezor offers eligible buyers a replacement shipped directly or a voucher covering a new device. Trezor also advises against opening the case or weighing the device to check it, since it says neither is a reliable test, and it expects scammers to use this incident in phishing emails, letters and phone calls. Trezor Support will never ask for your recovery phrase, and nobody with a legitimate reason ever will.
What this means if you're about to buy a hardware wallet
The Ledger and Trezor reports carry the same lesson for a first-time buyer, and it's about the route the box takes to reach you. The implant design described in both cases reads the words off the screen while you write them down, so the chip that guards your keys never has to be broken, which is why where you buy matters as much as which model you pick. Buying from the maker's own store, or from a seller the maker lists as authorized today, removes most of the hands a device passes through. Both companies have trimmed their reseller lists this autumn, so a seller on the approved list in the summer may have since been dropped. Our guide on where to buy a hardware wallet safely walks through the checks.
Because we make a competing wallet, our own position deserves a plain statement. Ryder One isn't immune to a tampered supply chain, and no hardware wallet is; the habit that helps most is the same for ours as for any other brand, which is to buy from the maker directly, and for us that's ryder.id. If you're weighing options for your first device, our checklist on your first hardware wallet covers what to compare beyond the brand name.
What we're watching
Trezor says its security team will examine the reported Safe 5 when it arrives and that it's working with Ledger and other parties. Three questions are still open: whether the board matches the ones found in Ledger devices, whether any Trezor owner has lost funds, and whether the problem reaches beyond CryptoBilis stock. We'll update this page as Trezor publishes its findings.
Share: