Trezor to Cut Authorized Resellers After Ledger Finds Spy Implant in Crypto Wallets
Key Takeaways
- •Trezor has informed partners their reseller authorization ends on January 1, 2027, and they will receive no new stock from the company.
- •Ledger's Donjon security team found that wallets sold by Southeast reseller CryptoBilis contained an unauthorized component that reads the screen, decodes the recovery phrase, and transmits it over LTE through a built-in eSIM.
- •The implant leaves the key-storage chip and operating system unaltered, so tampered wallets appear and function normally.
- •Onchain investigator Specter has traced more than $86 million in suspected thefts to the scheme, a figure Ledger has not verified.
- •Trezor stated there is no evidence any of its devices were compromised and has already removed CryptoBilis from its seller list.
Trezor is cutting its network of authorized resellers, telling partners their authorization will end on January 1, 2027, and that the company will ship them no new stock. The decision comes days after rival hardware wallet manufacturer Ledger launched an investigation that eventually confirmed a hidden spy implant in crypto wallets sold through a third-party store. Trezor says the move is designed to tighten oversight of its distribution channel following a string of supply-chain security incidents.
The company announced the move on X on Tuesday, saying there is “not a single piece of evidence” that any Trezor device has been compromised. It described the cuts as a preventive step taken purely out of caution.
“Following recent supply-chain incidents, we decided to reduce the number of resellers so we can more effectively check those we work with,” Trezor wrote.
What Ledger Found
Ledger’s Donjon security team says wallets sold by CryptoBilis, a reseller in Southeast Asia, contained an unauthorized component that reads the device’s screen and decodes the recovery phrase the moment it appears. The spy implant then sends the words out over LTE, the same mobile data network a smartphone uses, through an eSIM, a SIM card built into the hardware.
According to Ledger, the implant does not alter the chip that stores the keys or the device’s operating system, which means a tampered wallet looks and works normally. Onchain investigator Specter has traced more than $86 million in suspected thefts tied to the scheme, a figure Ledger says it has not verified.
A hardware wallet is a small device that keeps the secret keys to a user’s crypto offline, away from hackers. Setting one up produces a 24-word recovery phrase that works as a master password: whoever has those words can empty the wallet from anywhere in the world. Because the recovery phrase alone is enough to restore a wallet on another device, capturing it gives an attacker full access to the funds.
The Letter to Resellers
Trezor Chief Commercial Officer Danny Sanders shared the letter the company sent to the partners it is dropping.
“If you are receiving this letter, your authorization ends on 1 January 2027. On that date we will remove you from our list of authorized Trezor resellers,” the letter reads. “I am sorry. This decision says nothing about your effort or the way you represented us.”
“This is a precautionary measure to protect our supply chain and our customers,” Sanders wrote. “If things change in the future we will review it.”
Affected resellers will receive no new stock, but they can keep selling their remaining inventory through Black Friday and the holiday season. Sanders said the decision simply reflects how many partners Trezor can vet closely on its own. Neither the post nor the letter disclosed how many resellers are affected.
Trezor said it reviewed each country individually, weighing revenue and distribution against its own presence there. Resellers who remain will operate under an updated legal framework and tighter rules on how devices are sourced, stored, and handled. The January 1, 2027, change and the updated rules will therefore determine how buyers access authorized inventory after the current resellers’ remaining stock is sold.
Trezor also said on X earlier this week that CryptoBilis had already been removed from its seller list and that it had received no reports of tampered Trezor devices from the retailer.
“Hi, don’t open it. Forcing the casing open can damage the device, and if it’s a Safe 7, the built-in battery makes that genuinely risky. If something about your device worries you, reach out via , and we’ll take a look. We are actively investigating the…”
A History of Supply-Chain Concerns
In May 2022, Trezor warned that counterfeit Model T wallets were being sold on a Russian marketplace by a seller that was not an authorized reseller. The devices had been opened, resealed, and fitted with replaced internal components, and Trezor said the recovery phrases they generated were predictable or predefined, meaning someone else could already know the words. Trezor’s advice at the time was to buy only from its official shop or an authorized reseller—the second option being the very network it is now shrinking.
More recently, in August, shipping partner ShipMonk exposed Trezor customer data after unauthorized access, and the company’s September update put the number of affected customers at 80,689. Trezor says its own systems, devices, private keys, and wallet backups were not affected.
Ledger’s Warning to Buyers
Ledger has told anyone who bought a device from CryptoBilis in the past 90 days not to set it up, and has advised those who already did to move their funds to a new seed phrase on a device bought directly from Ledger. Both Ledger and Trezor have warned buyers against purchasing hardware wallets from unauthorized sellers.
