Hardware wallet maker Trezor said it will significantly reduce the number of authorized resellers permitted to sell its devices, with removals from the authorized list taking effect on Jan. 1, 2027. The company framed the decision as "a preventive step, taken out of an abundance of caution" in response to recent supply-chain incidents affecting the hardware wallet industry. Authorized resellers are third-party retailers a manufacturer formally approves to sell its devices.

The announcement came in a Tuesday post on X, in which Trezor stated that there is "not a single piece of evidence" that its devices have been compromised.

Following recent supply-chain incidents, we decided to reduce the number of resellers so we can more effectively check those we work with. Let us be very clear: there is not a single piece of evidence that Trezor devices have been compromised. This is a preventive step, taken…

— Trezor (@Trezor) October 13, 2026

Chief commercial officer Danny Sanders said some resellers have already been notified that they will be removed from the authorized list on Jan. 1, 2027. He added that shipments to those resellers would stop on Tuesday.

Trezor also shared a letter sent to select partners, in which it wrote that a hardware wallet is "only as safe as the path it travels to reach its owner." According to the letter, the company wants a reseller network small enough that it can vet every remaining partner. Those who stay in the program will face an updated legal framework and closer checks on how devices are sourced, stored, and handled.

To the resellers who helped build Trezor: thank you, and I'm sorry 💔 pic.twitter.com/RK7KBJOshp

— Danny (@Dantoshi) October 13, 2026

What Happened With Ledger

The decision came days after Ledger confirmed that at least one of its devices purchased from a Southeast Asian reseller contained an unauthorized hardware implant. The reseller in question is CryptoBilisn
According to reports, the implants were soldered into the devices. They captured users' recovery phrases and transmitted them over cellular networks. A recovery phrase is the master backup of a self-custody wallet — a sequence of words from which all of a wallet's private keys can be regenerated — so anyone who obtains it can take the funds without ever handling the hardware. The case also illustrates how a supply-chain attack operates: the compromise occurs between the factory and the buyer, in the physical distribution channel rather than in software.

The incident came to light on Oct. 9, 2026, when it emerged that attackers had allegedly tampered with devices sold through a third-party reseller.

CryptoBilis is also an authorized Trezor reseller. It suspended all hardware wallet sales during the investigation.

Separately, MediaMarkt's parent company said it removed all Ledger products from its physical stores and online platforms, describing the step as a precaution.

How Much Was Lost

Blockchain researchers are still working to measure the total losses. Research from two individuals suggested losses of between $72 million and $86 million, while other reports put the estimated total at $93 million.

Ledger said on Tuesday that it had not confirmed the total number of affected users or the total value lost.

Trezor's Response

A Trezor spokesperson told Cointelegraph that the company's setup checks are designed to catch counterfeit devices and modified firmware. The implant found in the CryptoBilis device works differently, the spokesperson said.

According to the spokesperson, the implant does not alter the device's firmware. Instead, it reads information displayed on the screen and sends it to the attacker at a later point. That behavior sits outside the security model hardware wallets are built around, which assumes a device's secrets never leave the hardware itself. Trezor said it has not seen this type of attack on its devices in the real world.

The company urged users to buy directly from Trezor and to verify that the device seal is intact. It also suggested using a multisignature wallet with devices from different manufacturers, so that a single compromised device cannot move funds on its own.

A Difficult Year for Hardware Wallets

According to the reports, hardware wallet firms have faced close to a dozen incidents this year, including data breaches, laser fault injection disclosures, and a firmware entropy bug. Laser fault injection is a physical technique that uses focused light to induce errors in a chip and potentially bypass its security checks, while an entropy bug refers to a weakness in the randomness that cryptographic key generation depends on.

Trezor dealt with its own incident in August, when a data breach at a third-party fulfillment provider exposed personal information belonging to tens of thousands of customers.

The most recent development is that Trezor's reseller removals will take effect on Jan. 1, 2027, just under three months after the announcement. Investigators continue to work to determine the full scale of the losses tied to the Ledger incident.