Trezor is reducing its global reseller network starting January 1, 2027 as a preventive measure following supply chain attacks on rival wallet manufacturer Ledger. Security analysts linked malicious hardware implants in Ledger devices sold by Southeast Asian reseller CryptoBilis to losses exceeding $72 million. Trezor emphasized that no Trezor devices have been compromised and that remaining authorized partners will face stricter sourcing and storage compliance checks.
Trezor reseller network reduction
- ▪In an October 13, 2026 letter, Trezor Chief Commercial Officer Danny Sanders informed dropped partners that the termination did not reflect partner wrongdoing or compromised local inventory.
- ▪Trezor Chief Commercial Officer Danny Sanders stated that dropped resellers will receive no new inventory shipments after October 13, 2026, but can sell remaining stock through the 2026 holiday season.
- ▪Trezor announced on October 13, 2026 that it is reducing its authorized reseller network starting January 1, 2027 as a preventive security measure.
Trezor reseller criteria and compliance
- ▪Trezor evaluated individual geographic markets based on revenue, distribution coverage, and Trezor's direct reach before determining which reseller partnerships to end.
- ▪Trezor announced that authorized resellers remaining in its network will be subject to stricter legal frameworks and tighter compliance checks regarding device sourcing, storage, and handling.
Trezor device security and guidance
- ▪Trezor stated that its setup checks catch modified firmware, whereas the hardware implant found in rival devices reads screen display data directly without altering firmware or internal operating systems.
- ▪Trezor advised hardware wallet buyers to purchase devices directly from official company stores, verify intact physical seals, or use multi-signature wallet configurations across different hardware brands.
- ▪Trezor stated on October 13, 2026 that there is no evidence that any Trezor devices have been compromised or tampered with in the supply chain.
Tampered Ledger devices and theft
- ▪Former Mt. Gox CEO Mark Karpelès reported finding a spying implant inside a Ledger Flex wallet purchased from a MetaPod retail outlet at Singapore's Changi Airport.
- ▪Blockchain security analysts estimated total crypto theft losses linked to the tampered Ledger wallets between $72 million and $103 million.
- ▪The hardware implant found in CryptoBilis-sold Ledger wallets decoded recovery phrases from the device screen and transmitted them over cellular networks using an embedded eSIM.
- ▪Rival hardware wallet maker Ledger confirmed that devices sold through Southeast Asian reseller CryptoBilis contained an unauthorized hardware implant that intercepted 24-word recovery phrases.
Actions against reseller CryptoBilis
- ▪Hardware wallet manufacturer OneKey revoked the authorization of reseller CryptoBilis and offered free device replacements to customers who bought devices between March and October 2026.
- ▪Southeast Asian reseller CryptoBilis was removed from Trezor's authorized reseller list following security incidents involving rival hardware wallet brand Ledger.
MediaMarktSaturn Ledger sales suspension
- ▪European retailer MediaMarktSaturn suspended physical and online sales of Ledger products across Europe after a report of a tampered Ledger device purchased in Germany.
- ▪Ledger stated that no financial losses had been reported in connection with the tampered hardware wallet reported in Germany.
Trezor ShipMonk data breach
- ▪Trezor warned that customer information exposed in the ShipMonk data breach could be used in phishing and targeted impersonation attacks.
- ▪A third-party ShipMonk data breach disclosed by Trezor in 2026 exposed order and contact details for nearly 81,000 Trezor customers.
Debatable claims
- ▪Hardware wallet manufacturers should eliminate third-party resellers
- ▪Hardware wallet makers bear financial liability for losses caused by tampered authorized resellers
- ▪Allowing dropped resellers to sell remaining inventory creates an unacceptable security vulnerability
Story comments
Loading comments…