Trezor reveals Malaysian reseller sold wallet with spyware

Trezor claims it has seen one of its crypto wallets sold by the official Malaysian-based reseller CryptoBilis containing a physical spyware implant.

The tampered wallet was Trezor’s ‘Safe 5’ model, and was bought from CryptoBilis in August this year. 

Trezor told Protos that the implant involves an extra circuit board fitted between the main board and the screen, with a cellular module and an antenna.

According to the user report, which Trezor has yet to thoroughly verify, the implant “reads what the screen shows, including the wallet backup, and sends it out over a mobile network whenever the device is plugged in.”

This is similar to how the previous spyware device in Ledger devices functioned.

Trezor’s Chief Commercial Officer, Danny Sanders, claimed, “We haven’t had the device in our lab yet, but we’re treating the report as credible, and we’d rather warn people now than wait for confirmation and find out someone lost their funds in the meantime.”

Buyers who purchased a wallet from CryptoBilis since March 2026 were told to move their funds out of their wallet and contact Trezor’s team, who will provide a replacement wallet. 

If you bought a Trezor with the reseller CryptoBilis after March 2026, move your funds to a new wallet right now.

We’ve received a report of 1 device with tampering. We believe this is a credible implant and we are acting fast on it. As of now, we have no reports of lost funds. https://t.co/COWrfvFJmD

Read more: Trezor says mailing breach leaked 67K more users than first thought

Trezor also told Protos that it has checked four other CryptoBilis-sourced Trezor wallets and “found no evidence of tampering.”

Trezor dropped CryptoBilis as one of its official resellers on October 9 in the wake of an $86 million Ledger wallet hack that relied on spyware installed in CryptoBilis-sold wallets. 

It now claims that it is reviewing its other Asia-based resellers.

Following the hack, Ledger dropped ties with official resellers across Malaysia, Indonesia, Singapore, Thailand, the Philippines, Vietnam, and Hong Kong.

Read more: Trezor’s summer of hacks continues with Brevo email breach

At the time of the Ledger wallet hack, Trezor claimed, “There is not a single piece of evidence that Trezor devices have been compromised.”

It maintained in today’s report that “No funds have been reported as stolen.”

Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.

The post Trezor reveals Malaysian reseller sold wallet with spyware appeared first on Protos.