Cryptocurrency hardware wallet maker Trezor said on Oct. 30 it received a tip that a hardware backdoor (implant) was found in the "Trezor Safe 5" sold by Southeast Asian reseller CryptoBilis. Trezor made the disclosure on its official blog.

Trezor said the hardware backdoor appears to work in a way similar to what was previously found in Ledger devices.

The report was submitted on Oct. 28 through its responsible disclosure programme. It involved a product an Indonesian customer bought in August on the Tokopedia e-commerce platform. According to the report, an extra board fitted with a cellular module and antenna had been inserted between the main board and the display. The board was said to read the recovery phrase (backup) shown on the screen and transmit it over a mobile network while the device was connected. Trezor said it has not been able to verify the details directly. The reporter noticed something was wrong after sensing a weight difference.

Trezor said it has not yet received the device. It said it reviewed photos and conducted a video interview and judged the report credible. It said it disclosed the information first because waiting for lab confirmation would leave buyers exposed to risk in the meantime. The reporter moved funds before finding the hardware backdoor, and no theft cases have been reported so far. The party behind it has not been identified. Trezor said it is sharing information with investigators including Ledger.

Trezor advised users who bought devices from CryptoBilis since March to move assets as soon as possible to a wallet created with a new seed. It said using a backup created on the affected device on another device is not a solution. If users do not have another hardware wallet, they can temporarily move funds to a software wallet or an exchange. It said users should not set up devices they have not used yet and should not enter existing backups. The guidance applies not only to the Safe 5 but to all Trezor products bought from CryptoBilis. It also applies to sellers, including Tokopedia shops, that sell products supplied by CryptoBilis. It said checking weight or opening the device is not reliable.

The user can keep the device and contact customer support to receive a new product shipment or a voucher equivalent to the purchase cost. Trezor warned that phishing attempts exploiting the incident could increase and urged users not to share recovery phrases with anyone. Trezor said it excluded CryptoBilis as a seller on Oct. 9 after continued reports of Ledger device tampering. It said there have been no reports involving other resellers.