Crypto: Trezor Tightens Reseller Network After Fake Ledgers

Trezor will reduce its network of authorized resellers from January 1, 2027. Dated October 13, 2026, this announcement follows security incidents affecting Ledger wallets sold by CryptoBilis. The measure aims to strengthen device control before delivery. Especially since no compromised Trezor device has been identified at this stage.

Crypto: Why is Trezor reducing its reseller network?

In a letter to partners made public on October 13, 2026, Trezor’s sales director, Danny Sanders, announced the withdrawal of accreditation from some of its crypto resellers. The goal: to strengthen supply chain control.

They will no longer receive new deliveries. However, they can sell devices already available until January 1, 2027. Trezor thus grants them the Black Friday and holiday period before their removal from the official list.

For now, the exact number of affected authorized resellers by this announcement remains unknown. The same applies to the markets concerned. Trezor will assess each country individually according to:

• revenue;
• distribution;
• local presence.

On a record dated October 13, 2026, the manufacturer counted 87 entries in its directory (spread across 44 countries). This corresponds to 80 distinct names, some sellers appearing in multiple countries. This figure describes the directory observed on that date and does not correspond to the number of resellers that will be withdrawn.

However, Trezor already emphasizes an important point: the retained partners will sign a stricter framework on supply, storage, and handling of devices. Danny Sanders insists on the preventive nature of the measure. He also apologizes to the affected companies.

There is no evidence whatsoever that Trezor devices have been compromised.

Danny Sanders, Trezor Sales Director, letter to resellers dated October 13, 2026, translated from English.

Crypto: How did the implant on modified Ledgers work?

The incident involves Ledger crypto wallets sold by CryptoBilis, a Southeast Asian reseller. The first confirmation concerns a crypto user’s device and dates back to October 10.

According to Ledger, these devices contained an unauthorized hardware component capable of reading the recovery phrase displayed during setup and then sending it via a mobile network. More explicitly, when the implant detects these screens, its microcontroller decodes the words, then transmits them via LTE using an eSIM. This can give the attacker access to crypto assets without retaining the device.

Ledger specifies an important point:

The implant is a separate component. It does not modify the Secure Element or Ledger OS and does not alter transactions or signatures.

Ledger, statement dated October 13, 2026, translated from English.

In other words, the hardware implant bypasses protection by capturing information displayed to the user. Still, the attack takes place before the device is delivered. Hence the supply chain stakes.

Losses remain unconfirmed estimates

Some researchers and media report estimates up to $93.2 million in losses, spread over more than 300 crypto wallets. These figures have been cited notably by CoinDesk, but Ledger has not validated them.

Other estimates circulate, between over $86 million and $103 million. They come from third parties and differ depending on:

• the accounting method;
• the crypto wallets considered;
• the observation date.

They should not thus be presented as a definitive assessment.

For its part, Ledger has confirmed neither the total number of affected crypto users nor the total value lost. The company indicates, however, that all confirmed losses related to the incident disclosed on October 9 involve devices sold by CryptoBilis. To this day, it continues examining reports from other locations.

We have not confirmed the total number of affected users nor the total value lost. The figures circulating online come from third parties and have not been fully verified by Ledger.

Ledger, statement dated October 13, 2026, translated from English.

A currently authorized partner might no longer appear in the Trezor directory after January 1, 2027. For a new crypto purchase, verification should focus on the distributor’s status at the time of the order.

Trezor also invites checking seals and performing authenticity checks in Trezor Suite. In case of anomalies in setup instructions or firmware, it is imperative to contact support. The manufacturer reminds users never to enter backup words on a site, application, or form.

For Ledger, instructions are more targeted. A device bought from CryptoBilis and never configured must not be initialized. If it has been used, Ledger asks to transfer crypto assets to a new device with a new recovery phrase.

With Trezor, crypto security essentially comes down to an industrial question: who controls the device before delivery? The tightening of the network could improve traceability. Its effect on product access remains to be measured, market by market. To be continued…

DISCLAIMER

The views, thoughts, and opinions expressed in this article belong solely to the author, and should not be taken as investment advice. Do your own research before taking any investment decisions.