Trezor cuts reseller network amid Ledger probe

TLDR

Trezor is shrinking its network of authorized resellers as a precaution after Ledger uncovered tampered hardware wallets in its reseller channel.

1. Trezor will end authorization for selected resellers in 2027, saying its own devices show no compromise but supply-chain checks need to be tighter.
2. Ledgers ongoing probe centers on spy implants in wallets sold via Southeast Asian reseller CryptoBilis, with tens of millions of dollars in estimated thefts still unconfirmed.
3. For crypto users, the story highlights that the biggest risk now is distribution-chain tampering, making direct purchases, seal checks and multi-vendor setups more important than brand loyalty alone.

Deep Dive

1. Trezors Preventive Reseller Cut

Trezor announced it will reduce its number of authorized resellers as a preventive step, taken out of an abundance of caution, with affected partners losing authorization on January 1, 2027 and shipments stopping immediately, while they can sell remaining stock until then. In its letter and X post, Trezor stressed there is not a single piece of evidence that its devices have been compromised and framed the move as tightening control so it can more rigorously vet fewer partners for sourcing, storage and handling. CryptoBilis, the Southeast Asian reseller implicated in Ledgers case, has already been removed from Trezors list, though Trezor says it has seen no tampering reports involving its own devices from that channel, according to coverage by Cointelegraph and CoinMarketCaps community update on how Trezor reduces resellers as a preventive step.

2. Inside Ledgers Supply-Chain Probe

Ledgers investigation focuses on a physical supply-chain attack in which devices sold through authorized reseller CryptoBilis contained an unauthorized hardware implant that reads the screen during setup to capture the 24-word recovery phrase and transmits it over LTE via an embedded eSIM. Ledgers Donjon team says the implant does not alter the Secure Element or operating system, so the device appears normal while silently leaking the backup phrase, as detailed in reports on the spy implant in Ledger devices. Independent researchers have estimated between roughly $72 million and more than $86 million in stolen crypto, but Ledger has not confirmed the total or number of affected users and stresses there is no indication its own infrastructure or direct sales channel were breached.

3. Practical Wallet Security Takeaways

For users, the key lesson is that even reputable hardware wallets can be compromised if attackers manipulate devices somewhere between factory and customer. Buying directly from the manufacturer, checking that packaging and security seals are intact, and avoiding preconfigured or pre-seeded devices are basic guardrails. Trezor and security researchers also suggest considering multisignature setups using devices from different vendors, so no single compromised device can move funds alone, and staying alert to official support notices if you bought through resellers in affected regions.

Conclusion

Trezors reseller cut and Ledgers probe both point to the same emerging risk: hardware wallets are only as safe as the distribution chains that deliver them. Crypto users who respond by favoring direct purchases, verifying devices carefully and spreading trust across multiple independent providers are better positioned if future supply-chain attacks surface.