Hardware wallet manufacturer Trezor is trimming its authorized reseller network after malicious implants were discovered in Ledger devices sold through third-party distributors, with blockchain investigators now estimating losses from the CryptoBilis incident at $102 million.

The episode shows how tampering introduced before a device reaches a buyer can sidestep a wallet's built-in cryptography entirely, shifting the security question from the hardware itself to the distribution chain that delivers it.

Trezor announced the precautionary changes on October 13 in a supply chain statement, confirming that affected distribution partners will lose their authorization on January 1, 2027. New shipments to those resellers have already stopped. The company has also removed CryptoBilis, a Southeast Asian retailer, from its authorized network after Ledger identified tampered devices distributed through the same business. Trezor stressed that it has received no evidence of compromised devices bearing its own brand.

Trezor Ends Reseller Agreements Beginning January 2027

Chief Commercial Officer Danny Sanders outlined the adjustments in a letter to distribution partners, explaining that Trezor could no longer maintain the same level of oversight across its existing reseller network.

Affected partners will be able to sell their remaining inventory through the holiday season but will receive no additional stock, and their authorization expires at the beginning of 2027. Trezor plans to introduce stricter partner verification alongside updated contractual requirements covering product sourcing, storage, and handling. Third-party retailers have long been central to how wallet makers reach local markets, but every intermediary adds another link between the factory and the customer — precisely the part of the supply chain now drawing heightened scrutiny across the industry after the CryptoBilis findings.

Sanders emphasized that the decision did not indicate misconduct by the affected resellers. He also publicly thanked longstanding partners and apologized for terminating their commercial relationships. Trezor has not disclosed how many retailers will lose authorization or which markets will be affected.

Ledger Links Wallet Drains to Hidden LTE Implants

The reseller overhaul follows Ledger's investigation into CryptoBilis-linked wallet drains affecting customers across Southeast Asia. Ledger's Donjon security team identified an unauthorized electronic implant concealed inside the affected hardware wallets. The component intercepted the 24-word recovery phrase displayed during device initialization and transmitted the data over LTE using an embedded SIM. Because a recovery phrase alone restores a wallet on any compatible device, a phrase captured at initialization gives an attacker access to whatever funds the wallet later holds — with no further need to touch the hardware.

According to Ledger, the implant operated independently of the Secure Element and did not modify the device's operating system or transaction signatures. The company has confirmed that the cases it investigated involved devices sold through CryptoBilis, while maintaining that its internal systems and direct sales channels remain unaffected (post X). The incident adds a new physical supply-chain dimension to concerns previously raised over Ledger's security record, which included earlier customer-data breaches and a software supply-chain exploit.

Blockchain intelligence firm Bitquery has since traced an estimated $102 million in stolen assets across 324 wallets on six blockchains, exceeding initial estimates of $86 million, according to its published investigation. The analysis identified coordinated withdrawals across Tron, Bitcoin, Ethereum, Solana, BNB Chain, and Polygon, while Tether froze approximately $10 million in USDT connected to the suspicious transfers. Ledger has not independently confirmed the total loss figure.

MediaMarkt Suspends Ledger Sales as Investigation Expands

The probe has also reached European retailers. MediaMarktSaturn suspended sales of affected Ledger products after a customer reported modified hardware purchased in Germany, having found additional wiring and cellular communication components inside two devices acquired from different MediaMarkt locations.

Ledger acknowledged the German report but said no associated fund losses had been identified, and the company has not established a connection between those devices and the CryptoBilis thefts.

Separately, another wallet manufacturer, OneKey, has revoked CryptoBilis' reseller authorization and offered free replacement devices to customers who purchased its products through the retailer between March 1 and October 13.

Ledger continues to advise CryptoBilis customers against initializing unused devices. Those who have already configured affected wallets should transfer their assets to a securely generated wallet with a new recovery phrase.

Open threads to follow include Ledger's unconfirmed total loss figure, whether the German MediaMarkt devices are ultimately linked to the CryptoBilis thefts, and any further tracing or asset freezes stemming from Bitquery's investigation and Tether's $10 million USDT action.

Trezor's broader reseller changes will take effect on January 1, 2027, with its revised distribution controls intended to reduce the number of intermediaries handling customer devices.

Source: Crypto Adventure