Trezor cuts authorized resellers over supply chain fears sparked by Ledger implant scandal
Trezor tightens distribution after Ledger implant scandal
Trezor is removing selected retailers from its authorized reseller network, with the changes taking effect on January 1, 2027. The move comes in the wake of a hardware implant investigation into rival wallet maker Ledger that has shaken confidence in how crypto hardware wallets reach customers. Trezor said it found no evidence that its own devices were compromised. The company called the restructuring a preventive measure.
Why Trezor is pulling authorized retailers
Trezor Chief Commercial Officer Danny Sanders wrote in an October 13 letter that the company could no longer adequately inspect every partner in its existing distribution network. He wrote: "A hardware wallet is only as safe as the path it travels to reach its owner." The company evaluated individual markets based on revenue, distribution coverage, and its ability to reach customers before deciding which partnerships to terminate. Trezor did not disclose how many businesses would be affected or which specific markets would lose authorization. Affected retailers will receive no additional inventory but can continue selling existing stock through the Black Friday and Christmas shopping seasons. Trezor will remove them from its authorized reseller directory on January 1. Sanders acknowledged the decision could have significant financial consequences for smaller retailers that built their businesses around Trezor products. He stressed the restructuring did not reflect wrongdoing by the affected partners or concerns about the safety of their existing inventory. "This is not a verdict on your business or on the safety of the devices you sell," he wrote. For retailers that keep their authorization, Trezor plans stricter contractual requirements and additional inspections covering how devices are sourced, stored, and handled.
What is known about the Ledger implant investigation
Ledger confirmed on October 10 that attackers installed an unauthorized electronic component inside a wallet sold by CryptoBilis, an official reseller operating in Southeast Asia. The implant could capture the 24-word recovery phrase displayed during wallet setup and transmit it through an LTE connection using an embedded eSIM. The component operated separately from the device's Secure Element and operating system, allowing attackers to obtain recovery credentials without interfering with normal transaction-signing functions. All verified thefts connected to the incident involved devices purchased through CryptoBilis, which has since stopped selling its products. On October 13, Ledger confirmed that MediaMarktSaturn had suspended sales of its hardware wallets across physical stores and online platforms in Germany following a report of an implanted device purchased there. Ledger said it had not reported any financial losses in connection with the German case. Separately, former Mt. Gox chief executive Mark Karpelès reported discovering a spying implant inside a Ledger Flex purchased from a MetaPod outlet at Singapore's Changi Airport. CryptoQuant analyst Darkfost also flagged a reportedly tampered Ledger Flex purchased from Challenger's VivoCity store in Singapore. Those findings have not been independently confirmed by Ledger or linked to the CryptoBilis attack. Darkfost subsequently expanded a watchlist of authorized retailers across Southeast Asia and Europe based on potential distribution exposure, while cautioning that inclusion did not establish compromise.
What remains unclear
The source and full extent of the suspected Ledger compromise are still unknown. Investigators are examining whether additional authorized retailers beyond CryptoBilis were involved, but no independent confirmation has been linked to the original CryptoBilis attack. It is also unclear how many Trezor resellers will be affected by the upcoming changes.
Why this matters
The Ledger implant cases have intensified scrutiny of where hardware wallets are modified before reaching customers. Trezor's decision to cut authorized resellers signals that the incident has real commercial consequences beyond the immediately affected brand, even as no Trezor devices have been shown to be compromised.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.