Trezor Cuts Its Resellers After Ledger Finds Spy Implant in Crypto Wallets

Trezor is cutting its network of authorized resellers, telling partners their authorization ends on January 1, 2027, days after rival hardware wallet manufacturer Ledger started an investigation that eventually confirmed a hidden spy implant in crypto wallets sold through a third-party store.

The company announced the move on X on Tuesday, saying “there is not a single piece of evidence” that Trezor devices have been compromised. It described the cut as a preventive step taken out of caution.

“Following recent supply-chain incidents, we decided to reduce the number of resellers so we can more effectively check those we work with,” Trezor wrote.

A hardware wallet is a small device that keeps the secret keys to your crypto offline, away from hackers. Setting one up produces a 24-word recovery phrase that works as a master password: whoever has those words can empty the wallet from anywhere in the world.

Ledger's Donjon security team says wallets sold by CryptoBilis, a reseller in Southeast Asia, contained an unauthorized component that reads the screen and decodes the recovery phrase when it appears. The spy implant then sends the words out over LTE, the same mobile data network your phone uses, through an eSIM, a SIM card built into the hardware. Ledger says the implant does not alter the chip that stores the keys or the device's operating system, so a tampered wallet looks and works normally.

Trezor CCO Danny Sanders shared the letter that the company sent to those providers that Trezor is ditching. “If you are receiving this letter, your authorization ends on 1 January 2027. On that date we will remove you from our list of authorized Trezor resellers,” the letter reads. “I am sorry. This decision says nothing about your effort or the way you represented us.”

This is a precautionary measure to protect our supply chain and our customers,” he wrote. “If things change in the future we will review it.”

Affected resellers will get no new stock, but they can keep selling what they have through Black Friday and the holiday season. Sanders said the decision just reflects how many partners Trezor can vet closely itself.

Neither the post nor the letter says how many resellers are affected. Trezor says it reviewed each country on its own, weighing revenue and distribution against its own presence there, and that resellers who stay will face an updated legal framework and tighter rules on how devices are sourced, stored, and handled.

Trezor said on X earlier this week that CryptoBilis was already off its seller list and that it had received no reports of tampered Trezors from the retailer.

In May 2022, Trezor warned that counterfeit Model T wallets were being sold on a Russian marketplace by a seller that was not an authorized reseller. The devices had been opened, resealed, and fitted with replaced internal components, and Trezor said the recovery phrases they generated were predictable or predefined, meaning someone else could already know the words.

Trezor's advice then was to buy only from its official shop or an authorized reseller. The second option is the network it is now shrinking.

In August, shipping partner ShipMonk exposed Trezor customer data after unauthorized access, and Trezor's September update put the total at 80,689 customers. Trezor says its systems, devices, private keys, and wallet backups were not affected.

Ledger told anyone who bought from CryptoBilis in the past 90 days not to set up their device, and told those who already did to move their funds to a new seed phrase on a device bought from Ledger. Ledger and Trezor have each warned buyers against unauthorized sellers.