Trezor Cuts Reseller Network After Ledger Wallet Tampering

Trezor is ending authorization for a significant part of its reseller network. In a letter to partners, the hardware wallet maker said the affected authorizations end on January 1, 2027, and those resellers come off Trezor's official list of authorized partners the same day.

The decision follows the Ledger supply-chain scare. Devices sold through CryptoBilis, a Southeast Asian reseller, carried unauthorized implants that could capture a user's 24-word recovery phrase. Trezor says there is no evidence its own devices were compromised, and calls the cut a precaution.

What Trezor has not said is which resellers lose authorization, or how many. Neither the letter nor the company's posts on X give a number, and its published reseller list shows no notice of the January 1 terminations.

What the Letter Says

Trezor chief commercial officer Danny Sanders shared the letter with selected partners on X. The key line is a flat denial that anything is wrong with Trezor hardware.

Let me be very clear: there is not a single piece of evidence that Trezor devices have been compromised. This is a preventive step, taken out of an abundance of caution.

Trezor said that following recent supply-chain incidents it decided to reduce the number of resellers so it can check the ones it works with more effectively, and that the network will be small enough for it to vet and check every remaining partner. Those who stay face an updated legal framework and closer checks on how devices are sourced, stored and handled.

Affected resellers keep what they have. Trezor said it will ship no new stock to them, but they can sell remaining inventory through Black Friday and the holiday season, up to the termination date. The company said it assessed each market on revenue, distribution capabilities and its existing presence there.

Who Loses Authorization

Trezor has not published a list of the partners being dropped. Its authorized reseller page currently names Alza stores in Austria, Czechia, Germany, Hungary and Slovakia, plus Amazon marketplaces in Australia, Canada, France, Germany, India, Italy and Japan, with no indication which of them, if any, received the letter.

Sanders apologised to the affected partners, saying the decision says nothing about their effort or the way they represented the company. He described the move as a precaution to protect Trezor's supply chain and customers, and said the company will review it if things change.

The Ledger Incident Behind the Decision

Ledger acknowledged that devices sold through CryptoBilis had unauthorized hardware implants able to intercept a user's 24-word recovery phrase during setup. Ledger's Donjon security team said the implant captures the phrase from the screen and sends it over LTE, which could cost users access to their funds.

Ledger's Sunday update said all confirmed cases involve devices sold through CryptoBilis, and that its own systems and direct sales channels were unaffected. It told buyers not to set up unused devices and, for anyone who already had, to move funds to a new recovery phrase on a Ledger device.

OneKey, which also cut CryptoBilis, froze new reseller approvals and said it will review every existing partner. CEO Yishi said any reseller whose business entity or ultimate beneficial owner cannot be verified loses authorization. OneKey said it had no reports of its users losing funds, and will replace devices bought from CryptoBilis between March 1 and Monday free of charge, with applications due by December 31.

The losses are disputed. On-chain analytics firm Bitquery said $102.0 million was taken from 324 wallets across six blockchains. Tether froze $10.0 million of USDT in 20 wallets, and about $82 million could still be traced on-chain as of Monday. Bitquery said the thief moved about 6,680 ETH through the Tornado Cash mixer between October 9 and October 12. The incident came to light on October 9, and other estimates of the damage run from more than $90 million to $93 million. Ledger has not confirmed any of these figures.

Trezor's Own Supply-Chain Record

This is not Trezor's first supply-chain problem this year. In August, its shipping partner ShipMonk was breached. Trezor's first notice said 11,742 customers had full exposure (name, email, phone number, shipping address) and 1,947 had partial exposure (name, city, email). A later update added about 67,000 US customers whose order data from November 2019 to August 2021 leaked. Those three groups add up to 80,689, the total Trezor gave in its September update.

Trezor said the breach happened at ShipMonk, that no Trezor system, product or service was affected, and that its devices remain safe.

Trezor has also dealt with tampering that had nothing to do with a reseller. In May 2022 it warned that counterfeit Model T wallets were being sold on a Russian marketplace by a seller that was not authorized. The cases had been opened, resealed and fitted with replaced internal components, and Trezor said the recovery phrases those devices generated were predictable or predefined, meaning someone else could already know the words.

January 1, 2027 is when the affected authorizations end and the names come off Trezor's public list. Until the company says otherwise, that reseller page is the only public record of who still counts as an authorized seller, and it carries no notice of who is leaving.