Trezor cuts reseller network after Ledger finds spy implant in wallets
Trezor shrinks reseller network after rival exposes spy implant
Hardware wallet maker Trezor announced on X on Tuesday that it will end reseller authorizations starting January 1, 2027. The move comes days after rival Ledger confirmed a hidden spy implant in crypto wallets sold through a third-party store in Southeast Asia.
Trezor said there is no evidence its own devices have been compromised. The company described the reseller cuts as a preventive step taken out of caution.
A hardware wallet is a small physical device that stores the secret keys to your cryptocurrency offline, keeping them away from online hackers. Each wallet generates a 24-word recovery phrase that acts as a master password: whoever has those words can drain the wallet from anywhere.
What Ledger found
Ledger's Donjon security team says wallets sold by CryptoBilis, a reseller based in Southeast Asia, contained an unauthorized component. The implant reads the wallet's screen, decodes the recovery phrase as it appears, and transmits the words over LTE using a built-in eSIM. Ledger says the device's key storage chip and operating system are untouched, so a tampered wallet looks and functions normally.
Onchain investigator Specter traced more than $86 million in suspected thefts linked to the implant. Ledger said it has not verified that figure.
What the Trezor letter says
Trezor CCO Danny Sanders shared the company's notice to affected partners. "If you are receiving this letter, your authorization ends on 1 January 2027," it reads. "I am sorry. This decision says nothing about your effort or the way you represented us."
Affected resellers will receive no new stock, but they may continue selling existing inventory through Black Friday and the holiday season. Sanders called it a precautionary measure to protect the supply chain and customers, adding that Trezor will review the decision if circumstances change.
What is confirmed
- Trezor is ending reseller authorizations on January 1, 2027, and stopping new shipments to those partners.
- Trezor stated there is no evidence its devices have been compromised.
- Trezor said CryptoBilis was already removed from its seller list before the broader announcement.
- No report of tampered Trezor devices from CryptoBilis has been received, according to the company.
- The number of resellers affected was not disclosed.
What is still unclear
- The exact number of resellers losing authorization has not been announced.
- Whether other third-party sellers outside Southeast Asia are using similar tampering methods remains unconfirmed.
Why this matters for wallet buyers
The incident highlights the risk of buying hardware wallets from unauthorized sellers. Both Ledger and Trezor warn that devices sourced outside official channels or approved resellers may be tampered with. Ledger advised anyone who bought from CryptoBilis in the past 90 days not to set up the device, and told those who already did to move funds to a new recovery phrase on a wallet purchased directly from Ledger.
Background
In May 2022, Trezor warned that counterfeit Model T wallets were being sold on a Russian marketplace by an unauthorized seller. Those devices had been opened, resealed, and fitted with replaced internal components, producing predictable or predefined recovery phrases. In August 2026, shipping partner ShipMonk exposed Trezor customer data after unauthorized access, affecting 80,689 customers. Trezor said its systems, devices, private keys, and wallet backups were not impacted.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.