The ex-CEO of the now-defunct Mt. Gox, Mark Karpeles, has flagged the potential compromise of Trezor hardware wallets sold by Southeast Asian reseller CryptoBilis, indicating that the recent supply chain attack on Ledger devices is not an isolated case.
"Ledger n'est pas la seule. @Trezor devices sold by CryptoBilis were also implanted," Karpeles said in an Oct. 30 post on X.
In his post, Karpeles advised customers who bought Trezor devices from CryptoBilis from March 2026 onwards to immediately transfer their cryptocurrency to new wallets with new recovery phrases.
He also offered to manually review potentially compromised devices, saying that he would be willing to cover the shipping fees if customers wished to get their wallets checked.
Karpeles's alert follows Trezor's confirmation that its security team was made aware of a credible report of a suspected hardware implant in a Trezor Safe 5 device.
As detailed in Trezor's Oct. 30 announcement, the device in question was acquired through the online marketplace Tokopedia in Indonesia in August 2026.
The report on the suspected device was received by Trezor on Oct. 28, and a video interview with the customer was conducted.
That said, Trezor said it hasn't checked the device in question in person to verify the report.
Details of the suspected hardware implant
The report states that the suspected compromised device has an extra board between the main board and the screen.
The extra board has a cellular module and an antenna that can receive data from the device, such as the wallet's recovery phrase.
Afterwards, the data can be sent via a mobile network when the hardware wallet is plugged in.
This suspected modus operandi is similar to the highly advanced hardware implants previously found in Ledger devices sold by CryptoBilis.
In fact, Ledger's investigation into suspicious fund losses involving the reseller began on Oct. 9. Later, it was confirmed that some Ledger devices had been physically tampered with.
On the same day, Trezor decided to cut ties with CryptoBilis as an authorized reseller.
Four devices bought by CryptoBilis customers have been checked by Trezor, but no signs of tampering have been found so far.
According to Trezor, no CryptoBilis customers have reported losing funds in connection with the suspected Trezor implant.
Despite this, Trezor recommends that affected customers create a completely new wallet instead of just restoring their existing recovery phrases on other devices.
Arman Shirinyan
Dan Burgin
