Trezor to Cut Authorized Resellers From January 2027 After Malicious Implants Found in Ledger Devices
Key Takeaways
- •Trezor will cut back its authorized reseller network effective January 1, 2027, following the discovery of malicious hardware implants in devices made by rival manufacturer Ledger.
- •Trezor stated it had no evidence that its own devices had been compromised.
- •The Ledger implants reportedly captured recovery phrases displayed during device setup and transmitted them over cellular networks, bypassing the device owner's internet connection.
- •Trezor said reducing the number of authorized resellers will allow it to scrutinize its remaining partners more closely.
- •The incident shows that hardware wallets can be compromised in the distribution chain before reaching users, shifting security focus from software alone to supply-chain integrity.
Trezor is cutting back its network of authorized resellers after malicious hardware implants were found in devices made by rival manufacturer Ledger, taking a more restrictive approach to protecting crypto wallets before they reach users.
Hardware wallets are physical devices that store the private keys controlling cryptocurrency holdings offline, keeping them away from internet-connected computers. Trezor, developed by Prague-based SatoshiLabs, and France-based Ledger are among the sector's most widely used manufacturers.
The move, reported by BitcoinKE, goes beyond checks of device software or firmware. targets the distribution chain itself — the point at which attackers can potentially modify physical devices without triggering conventional security checks.
Trezor said it had no evidence that its own devices had been compromised. The company will nonetheless stop supplying the affected resellers and remove them from its authorized network from January 1, 2027. Authorized resellers are third-party retailers that a manufacturer formally approves to sell its products, placing them on the official path a device travels before it reaches a buyer. According to Trezor, the reduction will allow it to scrutinize its remaining partners more closely.
The incident highlights a critical weakness in hardware wallet security: a device designed to keep private keys offline can still be compromised before it reaches its owner. In Ledger's case, unauthorized implants reportedly captured the recovery phrases displayed during device setup and transmitted them over cellular networks, a route that does not depend on the device owner's internet connection. A recovery phrase, sometimes called a seed phrase, is the sequence of words that can regenerate a wallet's private keys, meaning anyone who obtains it can typically access the funds it controls.
Trezor's response signals a shift away from relying primarily on device-level safeguards, treating reseller oversight and supply-chain integrity as part of wallet security itself. The removals take effect from January 1, 2027, so the composition of the remaining authorized network — and the scrutiny Trezor applies to the partners it keeps — will show the new approach in practice.
The case underscores that the decisive question is no longer just whether a hardware wallet's software is secure, but whether users can trust the physical device they receive.
