OFFLINE WALLET. ALLEGEDLY ONLINE.

The real news

The story, straight

A hardware wallet is a small device that keeps the secret key controlling your crypto offline. Its recovery words can rebuild that key on another device.

Anyone who copies those words can potentially control the funds. Think spare key, not forgotten-password hint.

That's why this report is unsettling: the safe allegedly came with a way to phone home.

In its 30 October 2026 notice, Trezor describes a suspected implant in 1 Trezor Safe 5 bought through reseller CryptoBilis on Tokopedia. Trezor received the report on 28 October but has not received or examined the device.

It considers the report credible, not confirmed.

According to the customer's description, an extra circuit board between the main board and screen contains a cellular module and antenna. It allegedly reads the screen, including recovery words, and transmits that information over a mobile network when plugged in.

An offline vault, allegedly upgraded to the family mobile plan. Nobody asked for unlimited betrayal.

Trezor says no CryptoBilis buyer has reported losing funds to it. The customer who reported this had already moved his funds before finding the suspected implant.

He did the responsible thing. The joke belongs to the supply chain, not him.

Trezor removed CryptoBilis as an authorized reseller on 9 October 2026. Its advice applies to every Trezor model bought through CryptoBilis from March 2026 onwards: move funds to a newly created wallet with new recovery words.

Restoring the old backup elsewhere does not solve the problem. If unused, don't set it up or enter an existing backup.

Contact Trezor Support through its official site.

The useful lesson: where your security device comes from matters. A vault shouldn't need a roaming agreement.

Repost so somebody checks their receipt instead of their reception.

Thanks for supporting Lil'meme. Your support is appreciated.