Trezor Prunes Its Reseller Network as Ledger Implant Probe Widens

Trezor will end authorization for an undisclosed number of resellers on January 1 while insisting none of its devices have been compromised. The move follows Ledger's confirmation of a hidden implant in a wallet sold by CryptoBilis, with estimated losses still unverified.

Trezor trims its seller list after a rival's tampering case

Hardware wallet maker Trezor said on Tuesday that it is reducing the number of resellers allowed to sell its devices. In an X post, the company called the step preventive and said there was "not a single piece of evidence" that its own wallets have been compromised, as reported by Cointelegraph and Bitcoin Magazine.

The announcement came days after Ledger confirmed that a device bought through the Southeast Asian reseller CryptoBilis contained an unauthorized hardware implant. Trezor cited recent supply-chain incidents and said fewer partners would let it vet each one more closely, according to Decrypt.

The Defiant summarized the development in similar terms. Its short report says CryptoBilis is already off Trezor's seller list and that the company describes the wider reduction as precautionary.

How the implant reportedly captured recovery phrases

A hardware wallet keeps private keys offline and generates a recovery phrase that acts as a master password for the funds. Anyone who learns that phrase can move the assets from anywhere, which is why a device that leaks it defeats the purpose of cold storage.

Decrypt reported that Ledger's Donjon security team found a component in CryptoBilis wallets that reads the screen and decodes the phrase when it is displayed. The component then sends the words out over a mobile data connection through an embedded eSIM. Ledger said the implant leaves the key-storing chip and the operating system untouched, so a tampered device looks and behaves normally.

A Trezor spokesperson told Cointelegraph that the company's verification steps are designed to detect fake units and altered firmware. The spokesperson said this attack works differently because it leaves firmware unchanged, and that Trezor has so far not observed this method used against its own devices outside the lab.

The figures behind the story

Several numbers circulate in the coverage, and they carry very different levels of confirmation.

• Ledger has confirmed an implant in at least one device, and Bitcoin Magazine says it has verified one affected user's device so far.
• Two researchers cited by Cointelegraph put user losses between $72 million and $86 million, while Bitcoin Magazine attributes the $86 million figure to investigator Specter.
• Ledger said it has not verified how many users were affected or how much value was lost, and that the figures circulating online come from third parties.
• Trezor's reseller authorizations end on January 1, 2027, according to Decrypt, and no outlet reports how many resellers are affected.
• According to Decrypt, Ledger advised buyers who purchased from CryptoBilis within the last 90 days to leave their devices unconfigured.

Where the outlets' accounts differ

The outlets agree on the core facts: Trezor is cutting resellers, calls it preventive, and says its devices show no sign of compromise. They differ on timing and detail. Cointelegraph reports that Trezor's chief commercial officer, Danny Sanders, told some resellers they would be dropped on Jan. 1 and that shipments to them would halt from Tuesday.

Decrypt gives the year as 2027 and adds that affected resellers can keep selling existing stock through Black Friday and the holiday season, but will receive no new inventory. It also quotes a letter from Sanders to the dropped partners that apologizes and says the decision is not a judgment of their effort.

Bitcoin Magazine frames the move more loosely, saying Trezor has reduced its resellers and is reviewing which vendors it deals with. It also describes CryptoBilis as Malaysia-based, while the other outlets use the broader Southeast Asian label. Cointelegraph adds that CryptoBilis was an authorized Trezor reseller and has suspended all hardware wallet sales, and that MediaMarkt's parent company pulled Ledger products from its stores and online platforms as a precaution.

A run of earlier incidents shapes the decision

Decrypt recalled that in May 2022 Trezor warned about counterfeit Model T wallets sold by an unauthorized seller on a Russian marketplace. Those devices had been opened and fitted with replaced components, and the recovery phrases they produced were predictable. Trezor's advice then was to buy from its own shop or an authorized reseller, which is the network it is now shrinking.

More recently, Decrypt reported that shipping partner ShipMonk exposed Trezor customer data in August, with the company's September update putting the total at 80,689 customers. Trezor said the incident did not touch its systems, devices, private keys or wallet backups.

Bitcoin Magazine places the case in a harder year for the sector. It reports that hackers took close to $120 million in bitcoin from Coldcard users in July because of a firmware bug in seed generation, according to maker Coinkite.

What buyers and project teams can check

The practical advice in the coverage is consistent. Trezor's spokesperson told Cointelegraph that users should buy directly from the company and check that the seal is intact. The spokesperson also suggested a multisignature setup using devices from different makers, so a single compromised device cannot move funds alone.

Decrypt noted that the resellers that remain will work under a revised legal framework and stricter requirements covering how devices are obtained, kept and handled. Teams that hold treasury funds on hardware wallets may want to review where their devices were purchased, since the reported attack leaves the device's firmware unchanged and is therefore not caught by firmware checks.

Open questions to watch

The scale of the losses remains unsettled, because the estimates come from outside researchers and Ledger has not verified them. Whether implants exist in devices sold through other channels is also unknown, although Ledger said on Tuesday that only CryptoBilis devices have been linked to lost funds, according to Bitcoin Magazine.

It is not yet clear how many Trezor partners will be cut, which countries are affected, or how the narrower network will change availability for buyers. Trezor also said it will review the decision if circumstances change, so the list could be revisited.

Market snapshot

Asset	Price	24h	7d	Market cap
Bitcoin (BTC)	$83,385	-0.5%	-1.1%	$1.68 trillion

CoinGecko data as of 2026-10-14 (UTC).

FAQ

Why is Trezor reducing its resellers?

Trezor describes the cut as a preventive step following recent supply-chain incidents, saying fewer partners will let it check each one more closely. It says there is no evidence that its own devices have been compromised.

How did the Ledger implant steal recovery phrases?

According to Decrypt, Ledger's Donjon team found a component in wallets sold by CryptoBilis that reads the screen when the recovery phrase appears and sends the words out over a mobile network through an eSIM. Ledger says the implant does not modify the key-storing chip or the operating system.

How much money was lost in the Ledger incident?

Ledger has not confirmed a total. Researchers cited by Cointelegraph estimate losses between $72 million and $86 million, and Ledger says those figures come from third parties and are not fully verified.

Sources

• Cointelegraph: Trezor reduces resellers as a ‘preventative step’ amid Ledger tampering reports (2026-10-13)
• Decrypt: Trezor Cuts Its Resellers After Ledger Finds Spy Implant in Crypto Wallets (2026-10-13)
• Bitcoin Magazine: Trezor Reduces Number of Resellers Following Ledger Drainage Incident  (2026-10-13)
• The Defiant: Trezor Shrinks Reseller Network After Hardware Wallet Supply-Chain Incidents (2026-10-13)
• CoinGecko (market data)