Trezor is reducing its network of authorized resellers after rival Ledger discovered a hidden surveillance component in wallets sold by a Southeast Asian third-party retailer. The affected Trezor partners have been told their authorization will end on January 1, 2027, while the company says there is no evidence that its own devices have been compromised.
The move follows Ledger’s investigation into wallets sold by CryptoBilis. According to Decrypt, Ledger’s Donjon security team found that the devices contained an unauthorized implant capable of reading recovery phrases displayed on the wallet’s screen and transmitting them over LTE through an embedded SIM card.
The incident highlights the security risks that can arise before a hardware wallet reaches a customer, even when the device appears to operate normally. Trezor said its decision was preventive and intended to give it greater control over the businesses handling its products.
Trezor narrows its distribution network
Trezor announced the reseller changes on X, saying it had decided to reduce the number of partners following recent supply-chain incidents. The company said it wanted to work more closely with the resellers that remain in its network.
Trezor Chief Commercial Officer Danny Sanders shared the letter sent to affected providers. It says their authorization will end on January 1, 2027, after which they will be removed from Trezor’s official list of authorized resellers. The letter also says the decision was not a judgment on the partners’ efforts or their representation of the brand.
The affected companies will not receive additional stock from Trezor. However, they can continue selling their existing inventory through Black Friday and the holiday season. Trezor has not disclosed how many resellers are affected.
The company said it assessed each country separately, considering factors including revenue, distribution arrangements and Trezor’s own presence in the market. Resellers that remain will operate under an updated legal framework, with stricter requirements covering the sourcing, storage and handling of devices.
Trezor said CryptoBilis was already absent from its authorized-seller list and that it had received no reports of tampered Trezor products from that retailer. It also stated that there was “not a single piece of evidence” that Trezor devices had been compromised.
How the Ledger implant worked
A hardware wallet stores the private keys used to control crypto assets offline. During setup, it creates a recovery phrase, generally made up of 24 words. That phrase acts as the master backup for the wallet: anyone who obtains it may be able to access and transfer the assets associated with the device.
Ledger’s Donjon team said the CryptoBilis-sold wallets included a component that captured the recovery phrase when it appeared on the device’s screen. The implant then sent the words over LTE, using an eSIM built into the hardware. LTE is the same type of mobile network used for cellular data on phones.
Ledger said the implant did not modify either the chip that stores the keys or the wallet’s operating system. As a result, a compromised device could look and function normally to its owner, making the interference difficult to detect through ordinary use.
Onchain investigator Specter has linked more than $86 million in suspected thefts to the incident. Ledger has said it has not independently verified that figure.
Ledger advised anyone who bought a device from CryptoBilis during the previous 90 days not to set it up. Customers who had already initialized one were told to move their funds to a new seed phrase generated on a device purchased from Ledger. Both Ledger and Trezor have warned customers to avoid unauthorized sellers.
Earlier supply-chain and customer-data concerns
The latest action follows earlier warnings from Trezor about counterfeit devices. In May 2022, the company said counterfeit Model T wallets were being sold by an unauthorized seller on a Russian marketplace. The devices had reportedly been opened, resealed and fitted with replacement internal parts. Trezor said the recovery phrases generated by those wallets were predictable or already known, potentially allowing another party to access funds.
Trezor advised customers at the time to buy through its official store or an authorized reseller—the network it is now making smaller.
The company also disclosed in September that unauthorized access at shipping partner ShipMonk had exposed data belonging to 80,689 Trezor customers. Trezor said its own systems, devices, private keys and wallet backups were not affected.
The distinction matters because a supply-chain compromise can target a product between manufacturing and delivery without necessarily breaking the wallet’s core software or key-storage chip. For customers, the provenance of a device and the chain of custody before purchase are therefore central parts of the security question.
Current crypto market picture
Moneyiar market data at 20:44 on October 13, 2026, showed Solana at $107.0700403684, down 1.36% over 24 hours and 11.52% over seven days.
Among the other assets covered by the data:
- edgeX was at $0.3334476927, down 5.29% in 24 hours and 25.46% over seven days.
- Sentient stood at $0.0198556473, down 6.6% over 24 hours and 22.5% over seven days.
- Walrus was at $0.0382582011, up 4.83% over 24 hours and 2.89% over seven days.
The wallet-security developments do not establish a connection with these price movements. They do, however, underscore the operational risks involved in holding digital assets, where control of a recovery phrase can determine access to funds.
