CryptoBilis reselleridan sotib olingan Trezor Safe 5 apparat hamyoni qo'shimcha elektron plataga ega bo'lib, u tiklanish iborasini mobil tarmoq orqali yuboradi, deb xabar berdi bir mijoz.
Trezor hali qurilmani tekshirmagan. U 2026-yil mart oyidan beri CryptoBilis'dan Trezor sotib olgan barchaga mablag'larini yangi hamyonga, yangi tiklanish iborasi bilan ko'chirishni aytmoqda.
Trezor 30-oktabr kuni blog postida xabar berishicha, bu xabar ikki kun avval Indoneziyadagi mijozdan kelgan. U hamyonni avgust oyida CryptoBilis'dan Tokopedia bozori orqali sotib olgan.
Xabarga ko'ra, plata hamyonning asosiy platasi va ekrani o'rtasida joylashgan bo'lib, unda uyali modul va antenna bor. U ekranni, jumladan tiklanish iborasini (Trezor uni hamyon zaxirasi deb ataydi) o'qiydi va qurilma ulangan har safar uni yuboradi.
Trezor mijozning fotosuratlari va tavsifiga ega va u bilan video qo'ng'iroqda suhbatlashgan. U hamyonni o'z laboratoriyasiga yuborishni tashkil etmoqda.
Trezor xabarni yetarlicha ishonchli deb topib, xaridorlarni hozir ogohlantirmoqda. "Laboratoriya tasdig'ini kutish CryptoBilis xaridorlarini shu orada xavf ostida qoldiradi", dedi kompaniya.
Hech bir CryptoBilis xaridori Trezorga mablag' yo'qotganini xabar qilmagan, chunki Trezor mijozlar hamyonlarida nima saqlanishini ko'ra olmaydi. Mijoz plata topilguncha mablag'larini hamyondan ko'chirgan edi.
Trezor maslahati 2026-yil mart oyidan beri CryptoBilis'dan sotib olingan har qanday Trezor modeliga, jumladan CryptoBilis ta'minlagan qurilmalarni sotgan har qanday do'konga, Tokopedia'dagi do'koniga ham tegishli:
- Agar siz allaqachon hamyondan foydalansangiz, mablag'laringizni iloji boricha tezroq yangi hamyonga, yangi tiklanish iborasi bilan ko'chiring. Eski tiklanish iborasini boshqa qurilmada tiklash yordam bermaydi, chunki buzilgan hamyon bu iborani allaqachon yuborgan bo'lishi mumkin.
- Agar sizda boshqa xavfsiz apparat hamyon bo'lmasa, mablag'laringizni hozircha siz bilgan dasturiy hamyonga yoki birjaga ko'chiring.
- Agar siz hamyonni hali sozlamagan bo'lsangiz, uni sozlamang va hech qachon mavjud tiklanish iborangizni unga kiritmang.
- CryptoBilis qurilmasini saqlang va Trezor Qo'llab-quvvatlash xizmati bilan bog'laning. Trezor sizga yangi qurilma yuboradi yoki uning narxini qoplaydigan vaucher beradi.
- Agar qurilmangiz qayerdan kelganiga ishonchingiz komil bo'lmasa, chekdagi sotuvchi nomini tekshiring yoki Trezor Qo'llab-quvvatlash xizmati bilan bog'laning.
30-oktabr holatiga ko'ra, Trezor boshqa hech bir reseller bilan bog'liq xabar olmagan.
Trezor ma'lumotiga ko'ra, egalar qurilmani o'zlari ishonchli tekshira olmaydilar va uni tortish yoki ochish orqali sinab ko'rmasliklari kerak. Mijoz og'irlik farqini sezgan, ammo kichik farqlar boshqa sabablarga ham ega bo'lishi mumkin.
Trezor shuningdek, firibgarlar bu hodisadan foydalanib, soxta elektron pochta, xatlar va telefon qo'ng'iroqlari orqali fishing hujumlarini amalga oshirishini kutmoqda.
Trezor 9-oktabr kuni Janubi-Sharqiy Osiyodagi vakolatli reselleri CryptoBilis bilan hamkorlikni to'xtatdi, chunki apparat hamyon ishlab chiqaruvchisi Ledger CryptoBilis'dan sotib olgan Ledger mijozlari orasidagi yo'qotishlarni tekshira boshlagan edi.
Ledger shundan beri ta'sirlangan mijozlardan birining hamyonida tiklanish iborasini sozlash paytida ushlash uchun mo'ljallangan ruxsatsiz apparat implant borligini aytdi.
Trezor Safe 5 da xabar qilingan plata Ledger qurilmalarida ko'rilgan implantlarga o'xshab ishlaydi, deb aytadi Trezor. Trezor tekshiruvlar davom etayotganda ikkalasini solishtirmaydi, chunki har bir ishlab chiqaruvchi o'z qurilmalarini turlicha quradi. U kim javobgar ekanligini bilmaydi.
Singapurda alohida politsiya ogohlantirishi
Singapur Politsiya Kuchlari 28-oktabr kuni ogohlantirishicha, Singapurdagi ba'zi chakana do'konlardan sotib olingan Ledger apparat hamyonlari zararli apparat komponentlarini o'z ichiga olgan. 10-sentabrdan beri kamida ikki holat xabar qilingan.
Komponentlar foydalanuvchilarning tiklanish iboralari yoki shaxsiy kalitlarini ushlashi mumkin. Politsiya tekshiruvlari davom etmoqda va Ledger ta'sirlangan holatlarni ko'rib chiqmoqda.
A Trezor Safe 5 hardware wallet bought from the reseller CryptoBilis has an extra circuit board that sends out the recovery phrase over a mobile network, a customer has reported.
Trezor has not yet examined the device. It is telling everyone who bought a Trezor from CryptoBilis since March 2026 to move their funds to a new wallet with a new recovery phrase.
Trezor said in a blog post on October 30 that the report came in two days earlier from a customer in Indonesia. He bought the wallet from CryptoBilis in August, through the marketplace Tokopedia.
The board sits between the wallet's main board and its screen, with a cellular module and an antenna, according to the report. It reads the screen, including the recovery phrase (Trezor calls it the wallet backup), and sends it out whenever the device is plugged in.
Trezor has the customer's photos and description and has interviewed him on a video call. It is arranging for the wallet to be sent to its lab.
Trezor finds the report believable enough to warn buyers now. "Waiting for lab confirmation would leave CryptoBilis buyers exposed in the meantime," the company said.
No CryptoBilis buyer has reported losing funds to Trezor, which cannot see what customers hold in their wallets. The customer had moved his funds off the wallet before he found the board.
Trezor's advice covers every Trezor model bought from CryptoBilis since March 2026, from any store that sold devices CryptoBilis supplied, including its store on Tokopedia:
- If you already use the wallet, move your funds to a new wallet with a new recovery phrase as soon as possible. Restoring the old recovery phrase on another device does not help, because a tampered wallet could already have sent that phrase out.
- If you have no other secure hardware wallet, move the funds for now to a software wallet or an exchange you know.
- If you have not set up the wallet, do not set it up, and never type your existing recovery phrase into it.
- Keep the CryptoBilis device and contact Trezor Support. Trezor will ship you a new device or give you a voucher that covers the cost of one.
- If you are not sure where your device came from, check the seller's name on your receipt or contact Trezor Support.
As of October 30, Trezor had no reports involving any other reseller.
Owners cannot reliably check a device themselves and should not weigh or open it to try it, according to Trezor. The customer noticed a weight difference, but small differences can have other causes.
Trezor also expects scammers to use the incident to carry out phishing through fake emails, letters, and phone calls.
Trezor dropped CryptoBilis, its authorized reseller in Southeast Asia, on October 9, after hardware wallet maker Ledger began investigating losses among Ledger customers who had bought from CryptoBilis.
Ledger has since said that one affected customer's wallet contained an unauthorized hardware implant built to capture the recovery phrase during setup.
Trezor says the board reported in its Safe 5 appears to work like the implants seen in Ledger devices. Trezor will not compare the two while investigations continue, because each maker builds its devices differently. It does not know who is responsible.
Separate Police Advisory in Singapore
The Singapore Police Force said in an advisory on October 28 that Ledger hardware wallets bought from some retail stores in Singapore contained malicious hardware components. At least two cases have been reported since September 10.
The components could capture users' recovery phrases or private keys. Police investigations are ongoing, and Ledger is reviewing the affected cases.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.