Trezor will stop its partnerships with some resellers starting January 1, 2027 due to the findings of its rival, Ledger, about altered wallets sold via CryptoBilis.
In a press release dated October 13, 2026, Trezor stated that “there is not a single piece of evidence that Trezor devices have been compromised.” The issue at hand is what happens to wallets between the time they leave Trezor’s premises and the time they reach customers.
What Sanders told the resellers
According to Chief Commercial Officer, Danny Sanders, the affected partners will receive neither new supply nor authorizations from January 1, 2027. The remaining partners are now required to follow stricter guidelines for sourcing, handling, and storing their supplies. Trezor has not revealed the number of resellers affected by the decision.
In the letter to resellers, Sanders has said:
“I am sorry. This decision says nothing about your effort or the way you represented us.”
The decision was made to improve oversight and does not mean that all cut-off resellers have done something wrong.
The implant Ledger found inside CryptoBilis wallets
According to Ledger Donjon on October 13, 2026, an unauthorized chip was discovered in wallets supplied by CryptoBilis. The chip recorded the 24-word recovery phrase that was shown during the initialization of the wallets.
The investigators elaborated:
“its microcontroller decodes the words and transmits them over LTE using a provisioned eSIM.”
The Secure Element, operating system, and transaction signing went unaffected by the implant. That means the wallet will continue to look normal while revealing the recovery phrase necessary for accessing the funds.
Loss estimates do vary. While Specter reported losses of more than $86 million, other reports have put the figure at around $93.2 million, while Yfarmx has given an estimate of $103 million. Ledger has not confirmed these numbers. Tether has frozen assets worth $10 million in USDT that are related to this case.
Cryptopolitan has earlier covered how the implant functions.
Why rivals are cutting the same reseller
OneKey has also canceled the authorization held by CryptoBilis. Users who obtained its products from March 1 to October 12, 2026, can apply for free replacements, including for activated wallets. Other brands sold by CryptoBilis have not confirmed thefts associated with them.
CryptoBilis customers who own unused Ledger wallets should avoid setting up the device. Those who are already using them should transfer their funds to a wallet where the recovery phrase has been newly generated from a device purchased directly from Ledger. They should contact official support and avoid disclosing recovery phrases.
Trezor has given detailed instructions to its potential wallet buyers. Check its list of authorized resellers to confirm the seller is legitimate. Upon delivery, check the tamper seals and conduct authenticity checks using Trezor Suite. If anything looks out of place, especially the firmware or setup instructions, contact Trezor. These precautions may help prevent possible hacks. But they cannot catch every hidden hardware modification.
What tighter distribution does to the wider market
Reports from Mordor Intelligence indicate the hardware-wallet market will evolve from $720 million in 2026 to $2.25 billion in 2031. Chainalysis ranks Brazil at the forefront of grassroots cryptocurrency adoption, pointing to growing demand for self-custody.
Having fewer resellers could mean better security control, but it may also complicate the acquisition of wallets.
The stakes are extremely high already. TRM Labs has reported a total of 207 hacking cases involving cryptocurrencies and around $972 million stolen in the first half of 2026. CryptoBilis brought another threat to light: a hacker can hack a wallet even before the owner has had a chance to open the unit.
The smartest crypto minds already read our newsletter. Want in? Join them.