Trezor Cuts Reseller Network After Ledger Devices Found with Hidden Tampering Implants

Trezor removes resellers from its authorized list

Hardware wallet maker Trezor has announced it will reduce its number of resellers, calling the move a "preventive step, taken out of an abundance of caution." The company made the announcement in a Tuesday post on X following reports that malicious hardware implants were found in Ledger devices, a competing product.

Trezor stated there is "not a single piece of evidence" that its own devices have been compromised. However, the company said the recent supply-chain incidents warranted tightening its distribution channels.

Chief commercial officer Danny Sanders confirmed he notified certain resellers that they would be removed from Trezor's list of authorized entities starting January 1, and that shipments of Trezor devices to those resellers would stop immediately.

Key facts

• Trezor's CCO Danny Sanders notified some resellers they would be removed from the authorized list on January 1.
• Shipments to affected resellers were halted the same day Trezor made its public announcement.
• Trezor says it has found no evidence its devices have been compromised.
• The company cites "recent supply-chain incidents" as the reason for the change.
• Ledger confirmed at least one of its devices sold through a Southeast Asian reseller contained an unauthorized hardware implant.
• Blockchain researchers estimated losses between $72 million and $86 million, though Ledger has not confirmed these figures.

How the Ledger tampering worked

Ledger confirmed on Tuesday that at least one of its devices, purchased by a Southeast Asian reseller called CryptoBilis, contained an unauthorized hardware implant. The implant did not modify the device's firmware. Instead, it read information displayed on the screen — including recovery phrases, which are the secret word sequences that give full access to a wallet — and transmitted that data over cellular networks to an attacker.

A Trezor spokesperson told Cointelegraph that the company's built-in setup checks are designed to catch counterfeit devices and modified firmware. The implant used in the Ledger incident, the spokesperson said, works differently because it bypasses firmware checks entirely by reading screen content and sending it externally.

What is confirmed and what is still unclear

Confirmed by the sources:

• Trezor announced the reseller reduction and named the January 1 effective date for removals.
• Ledger acknowledged the hardware implant in at least one device sold through CryptoBilis.
• The implant read recovery phrases and transmitted them over cellular networks.
• CryptoBilis, an authorized Trezor reseller, suspended all hardware wallet sales during the investigation.
• The parent company of MediaMarkt removed Ledger products from its physical stores and online platforms as a precautionary measure.

Still unclear:

• Ledger said it has "not confirmed the total number of affected users or the total value lost."
• The $72 million to $86 million loss estimates come from independent blockchain researchers and have not been verified by Ledger.

Advice for users

A Trezor spokesperson recommended that users buy products directly from the company and verify that the product seal is intact. The spokesperson also suggested considering a multisignature wallet setup, which uses devices from different manufacturers so that a single compromised device cannot move funds on its own.

Sources

• Cointelegraph — Trezor reduces resellers as a 'preventative step' amid Ledger tampering reports

Read also: Trezor cuts reseller network after Ledger finds spy implant in wallets

Read also: Ledger Finds Hidden LTE Implant That Stole Recovery Phrases From Wallets Sold by CryptoBilis

Read also: Trezor cuts authorized resellers over supply chain fears sparked by Ledger implant scandal