Trezor's CryptoBilis Warning Covers Every Order Since March. Move Your Coins.

Trezor has told customers who bought hardware wallets from reseller CryptoBilis since March to move their funds to a new device. The reason given: a report of a suspected hardware implant. That's the disclosure. No serial numbers. No inspection report. No public writeup of what was allegedly found and where inside the unit.

Hardware wallets have one job. Keep the private key offline. An implant attacks that promise at the physical layer, before a seed phrase is ever generated, which means the recovery words a buyer carefully writes on the card belong to whoever built the thing. And the window here isn't one bad batch. Since March is months of inventory passing through a single reseller's hands.

Look at the track record. In January 2024, Trezor confirmed a breach at a third-party support portal that exposed data on roughly 66,000 customers. Different failure, same lesson, and the lesson is that the weak points around these devices are people and shipping, not cryptography. Buy direct from the manufacturer has been the standing advice for years. Every reseller that shaves a few dollars off the price is asking buyers to spend trust instead.

The burden of proof sits with the team, not the community. If a unit came back with something soldered inside it, publish the photos. Publish the inspection. Publish the serial range so a buyer can check the box sitting in a desk drawer. Show me the audit. "Move your funds" is sound advice, and it's also the cheapest possible version of a security bulletin.

Here's who wins and who loses. Direct-to-consumer sales win, again, for the most boring reason possible. Buyers eat the cost of a replacement device and the hassle of rotating seeds, and the reseller channel takes another hit it probably can't afford. The winners are the firms that get paid to open these devices up and photograph what's inside.

Watch whether CryptoBilis responds at all, and whether Trezor widens the warning past March.