Trezor Thins the Herd: Resellers Get the Boot as Ledger's Spy Chip Scandal Spreads

Hardware wallet maker Trezor is slashing its authorized reseller network in response to a rival's supply-chain incident, telling affected partners their authorization ends January 1, 2027. The company announced the move on Tuesday via X, framing it as a preventive step "taken out of an abundance of caution." "There is not a single piece of evidence that Trezor devices have been compromised," Trezor wrote, adding that CryptoBilis, the Southeast Asian reseller at the center of the rival incident, had already been removed from its own seller list. Trezor said it has received no reports of tampered Trezor devices.

The trigger was a confirmed spy implant found in devices made by rival Ledger. Ledger's Donjon security team verified that a wallet sold through CryptoBilis contained an unauthorized component that reads the screen, decodes the 24-word recovery phrase when it appears during setup, and transmits the words over LTE through a built-in eSIM. According to Ledger, the implant does not alter the secure element chip or the device's operating system, so tampered wallets appear and operate normally. Blockchain researchers, including teams at Bitquery, estimate suspected losses above $93 million, with separate research from two individuals placing the range between $72 million and $86 million. Ledger has not confirmed a total, stating only that "we have not confirmed the total number of affected users or the total value lost." All confirmed cases trace to CryptoBilis, though users have claimed tampered devices reached Europe, which Ledger has not confirmed.

Trezor Chief Commercial Officer Danny Sanders shared the letter sent to dropped partners. "If you are receiving this letter, your authorization ends on 1 January 2027. On that date we will remove you from our list of authorized Trezor resellers," the letter reads. "I am sorry. This decision says nothing about your effort or the way you represented us." Affected resellers have stopped receiving new stock but can sell remaining inventory through Black Friday and the holidays. Sanders said country-level decisions weighed revenue, distribution, and Trezor's own direct reach, and that retained partners will face an updated legal framework plus tighter rules on sourcing, storage, and handling. Neither the post nor the letter specifies how many resellers were cut or where they operate.

A Trezor spokesperson told reporters that the implant found in the CryptoBilis device works differently from counterfeit schemes Trezor's checks are designed to catch. "This is a unique way of tampering with the device, which doesn't modify the firmware, but reads information on the screen and later sends it to the attacker," the spokesperson said, adding, "So far, we have not seen this specific type of attack on Trezor devices in the real world." Trezor advised users to buy directly from the manufacturer, verify that the seal is intact, and consider a multisignature wallet with devices from different makers so a single compromised device cannot move funds on its own.

CryptoBilis has suspended all hardware wallet sales during the probe. The parent company of European electronics retailer MediaMarkt also removed all Ledger products from its physical stores and online platforms "as a precautionary measure." Ledger has called for shared anti-tamper standards across all wallet makers, while Trezor, for now, is tightening its own sales chain first. $BTC holders and other crypto users are watching to see whether additional resellers are named as the investigation continues.