Trezor will remove selected authorised resellers from its distribution network on 1 January 2027, following a hardware-implant incident involving rival manufacturer Ledger.
In a letter dated 13 October, Trezor chief commercial officer Danny Sanders said the company was tightening supply-chain controls after the Ledger investigation raised concerns about how malicious components could be inserted into cryptocurrency wallets before they reach customers.
Trezor said it had found no evidence that devices in its own network had been compromised. It described the changes as a precautionary restructuring rather than a response to wrongdoing by any reseller.
“A hardware wallet is only as safe as the path it travels to reach its owner,” Sanders wrote.
The company said it had reviewed partnerships according to revenue, distribution coverage and its ability to reach customers before deciding which retailers would lose authorisation. Those businesses will not receive further stock, although they can continue selling existing inventory through the Black Friday and Christmas shopping periods.
They will also be removed from Trezor’s authorised reseller directory on 1 January. The company has not said how many retailers will be affected or identified the markets involved.
Sanders accepted that the decision could have serious financial implications for smaller businesses built around Trezor products. However, he said the move was not a judgement on their conduct or on the safety of the devices already in their possession.
“This is not a verdict on your business or on the safety of the devices you sell,” he said.
Retailers that retain their authorisation will face tighter contractual conditions and further checks on how Trezor devices are sourced, stored and handled. The measures are expected to increase compliance requirements while giving Trezor more control over inventory before it reaches customers.
Ledger incident prompts wider scrutiny
Ledger confirmed that attackers had installed an unauthorised electronic component in a wallet sold by CryptoBilis, an official reseller in Southeast Asia.
Ledger’s Donjon security team said the implant could record the 24-word recovery phrase shown during setup and send it over an LTE connection through an embedded eSIM. It operated independently of the wallet’s Secure Element and operating system, meaning normal transaction-signing functions could continue unaffected.
Ledger announced the discovery on 10 October and said every verified theft linked to the incident involved devices bought through CryptoBilis, which has stopped selling its products. Investigators are also assessing reports involving other authorised retailers.
On 13 October, MediaMarktSaturn suspended sales of Ledger hardware wallets in its physical shops and online after a report of an implanted device bought in Germany. Ledger said no financial losses had been reported in that case.
Former Mt. Gox chief executive Mark Karpeles separately reported finding a spying implant in a Ledger Flex bought at a MetaPod outlet at Singapore’s Changi Airport. CryptoQuant analyst Darkfost also identified a reportedly tampered Ledger Flex from Challenger’s VivoCity store in Singapore.
Neither report has been independently confirmed by Ledger or connected to the CryptoBilis incident. Darkfost later expanded a watchlist of authorised retailers across Southeast Asia and Europe, while stressing that inclusion did not prove any device had been compromised.
Independent blockchain investigators have associated suspected losses nearing $93 million with the wider incident, although Ledger has not verified the amount or the number of affected customers. The company says its internal systems and services remain secure, while its Donjon team examines additional devices to determine how far the tampering extends.
