News

Trezor warns 04.11.2026: CryptoBilis implant

Weekly overview for the Baltic and Nordic segment: the hardware wallet supply chain attack, previously affecting Ledger, has now spread to Trezor – on 30 October, Trezor issued a warning about a Safe 5 sold by CryptoBilis with a reported seed-stealing implant. With context and recommendations for buyers in the region.

Toms Ābeltiņš

4 November 20266 min read

There have been no new, clearly datable events in our segment over the past 24 hours, so we are providing a weekly overview. The new development of the week: on 30 October, Trezor officially warned about a Safe 5 sold by CryptoBilis with a reported hardware implant, marking the first time Trezor has been affected by the same supply chain attack we covered for Ledger on 16 and 27 October. With practical advice for Baltic and Nordic buyers.

Wednesday, 4 November 2026. This is a Week Brief format publication. Over the past 24 hours, there have been no entirely new, clearly datable events in our segment – crypto exchanges and CASPs, hardware wallets, crypto cards, and tax tools serving the Baltics (LV, LT, EE) and Northern Europe (FI, SE, NO, DK) – that could honestly be presented as “yesterday’s news”. Therefore, we are providing a weekly overview with precise dates on one topic where a new development has emerged in the past week: the hardware wallet supply chain attack, previously associated mainly with Ledger devices, officially affected Trezor on 30 October. We already covered the Ledger side in our 16 and 27 October editions, so this time we provide it only as brief context, focusing primarily on the new development – the Trezor case.

The new development: Trezor Safe 5 with a reported implant

The most significant new event of the week is that the same supply chain issue that affected Ledger has now been documented with Trezor. On 28 October, a customer in Indonesia reported to Trezor a potentially modified Trezor Safe 5, which they had purchased in August from reseller CryptoBilis on the Tokopedia platform. On 30 October, Trezor published an official statement, “Implant reported in a Trezor sold by CryptoBilis,” and on 2 November, security and industry media reported on it more widely. This is the first publicly documented instance where this attack scheme has been attributed to a Trezor device, not just Ledger.

According to the customer’s description, an additional circuit board with a mobile communication module and antenna was inserted between the main board and the screen. This implant reads what is displayed on the screen – including the wallet’s backup or seed phrase – and transmits the data over the mobile network when the device is connected. Trezor emphasises that it does not yet have physical possession of the device and defers technical conclusions until its own examination, but considers the report credible and notes that the implant’s operating principle appears similar to what was found in the Ledger case. Trezor did not name the organisers of the attack.

Trezor’s recommendation is broad: it applies to any Trezor device purchased from CryptoBilis since March 2026 – both directly and through stores that received goods supplied by CryptoBilis. Trezor terminated its partnership with CryptoBilis as a reseller on 9 October. As of the time of publication, no CryptoBilis buyer had reported actually lost funds to Trezor; the initial reporter’s funds had also been moved before the implant was discovered. This limits the confirmed damage but does not diminish the fundamental risk.

Brief context: Ledger side (already covered on 16 and 27 October)

As a reminder and without repeating it as fresh news: the Ledger incident is dated 9 October, when the company began investigating fund thefts from customers who had purchased devices from CryptoBilis. On 13 October, Ledger’s security division, Donjon, published technical findings on the hardware implant, and on 14 October, Ledger asked resellers in Southeast Asia and Hong Kong to halt sales. Loss estimates vary across independent investigations and are not cumulative: on 16 October, Bitquery counted approximately 102 million US dollars across 335 wallets, while on 29 October, Arkham estimated potential thefts of 95.35 million dollars across 1486 addresses. In Europe, the confirmed retail case so far is MediaMarkt in Germany, which received devices from distributor Aqipa GmbH and removed the product from sale; Ledger stated that in this case, funds were not lost and that it was not related to CryptoBilis.

Why device self-checks do not detect implants

In both cases, the nature of the attack is the same and therefore so dangerous: it is a hardware, not a software, attack. Ledger Donjon describes that the implant’s microcontroller recognises and decodes the 24-word backup phrase and transmits it over the LTE network using an embedded eSIM. Crucially, the implant does not alter the Secure Element, operating system, or transaction signing, so Ledger’s internal integrity self-checks do not detect it – the device functions as genuine from the user’s perspective.

This means that common authenticity verification methods may not help here: authentication confirms the validity of the components being checked, but the implant is located next to the genuine electronics. Trezor specifically warns that weighing the wallet is not a reliable test and that there is no safe way to self-check the device. Practically, the only protective mechanism remains control over the source of purchase – buying only from the manufacturer’s official channels or verified partners and avoiding third-party marketplaces and unreliable resellers.

What this means for Baltic and Nordic buyers

Ledger and Trezor are two of the most popular hardware wallet brands among private users in the Baltic and Nordic countries, so the story is directly relevant to our region, even if confirmed cases of modified devices have so far been linked to the Asian reseller CryptoBilis and one retail case in Germany. As of this publication, there are no reports of a modified device being sold through any Baltic or Nordic retailer.

The practical lesson for users in the region is clear. Firstly, for hardware wallet purchases, choose the manufacturer’s official store or its directly approved sellers, rather than anonymous marketplace offers or used devices. Secondly, if a device was purchased from an unclear source and already holds funds, the safe course of action is to move funds to a new wallet with an entirely new seed; restoring an existing backup phrase on another device does not solve the problem, as the phrase may already be compromised. Thirdly, never enter your backup phrase into a computer, web page, or app – manufacturer support will never ask for it, and such incidents almost certainly trigger a wave of phishing attempts.

Watchlist (ongoing stories, not fresh news)

These points are not news from the last 24 hours; we are keeping them under observation with precise dates.

Trezor’s technical examination of the received device is the main anticipated step – its conclusions will confirm or clarify the nature of the implant and how widely the CryptoBilis supply chain was affected. Until then, Trezor’s assessment remains based on the customer’s description, not the company’s own expertise.

ESMA’s MiCA register remains the most important structural indicator for our segment. According to the latest publicly available compilations (as of 19 October), there were around 377 licensed CASPs in the European Economic Area; we covered the regional movement in the 29 October segment overview. The next update and potential new Baltic or Nordic CASPs are worth following.

It is also worth monitoring whether regional supervisors – Latvijas Banka, Lietuvos Bankas, Finantsinspektsioon, FIN-FSA, or the Nordic Finanstilsynet – will issue separate consumer warnings about modified hardware devices; as of this publication, there are none.

Norriwire Briefing