Trezor Cuts Resellers After Ledger Hardware Wallet Tampering

Trezor is severing ties with a portion of its authorized hardware wallet resellers, halting shipments to select distributors immediately and scheduling their formal removal from the company’s approved network by Jan. 1.

Chief Commercial Officer Danny Sanders confirmed the distribution cuts Tuesday, framing the move as a preemptive supply-chain hardening measure rather than a response to any known compromise of Trezor devices. The Prague-based manufacturer stated it has found no evidence that its own products have been tampered with.

The restructuring follows the discovery of sophisticated physical implants inside Ledger hardware wallets sold through CryptoBilis, a Southeast Asian distributor that also held authorization to sell Trezor products. Unlike typical supply-chain attacks that rely on flashing modified firmware onto a device before it reaches the consumer, the implants identified in the Ledger units operated entirely at the hardware layer. They optically captured recovery phrases directly from the device screen and transmitted the sensitive data to attackers over cellular networks, bypassing the cryptographic integrity checks that standard firmware verification tools are designed to catch.

CryptoBilis suspended all hardware wallet sales while the investigation unfolded. The fallout extended beyond the cryptocurrency sector, prompting the parent company of European electronics giant MediaMarkt to pull all Ledger inventory from its physical retail locations and e-commerce platforms.

Blockchain researchers estimate the financial damage from the compromised Ledger devices could range between $72 million and $86 million, though Ledger said Tuesday it has not yet confirmed the total number of affected users or the precise value of stolen assets. Tracing the full scope of losses remains difficult because hardware wallets typically hold private keys for multiple blockchain networks simultaneously, and victims often do not realize their seed phrases have been exfiltrated until funds begin moving.

Hardware wallets from manufacturers like Trezor, Ledger, and Coldcard function as air-gapped signing devices, keeping private keys isolated from internet-connected computers. This security model assumes the physical hardware remains untouched between the factory floor and the end user. The Ledger incident demonstrates that threat actors can exploit the distribution chain itself, inserting parasitic components that leave the original firmware completely intact while still draining user funds.

Because these optical and cellular implants evade traditional software-based authenticity checks, Trezor advised customers to purchase devices exclusively through direct channels and verify that factory seals remain unbroken upon delivery. For users managing substantial portfolios, the company recommended adopting a multisignature architecture utilizing hardware devices produced by different manufacturers. Under a multisig setup, executing a transaction requires authorization from multiple independent keys, meaning a single compromised device cannot unilaterally move funds.

Trezor’s decision to shrink its third-party distribution footprint signals a broader shift in how hardware wallet manufacturers evaluate retail risk. Historically, expanding reseller networks was essential for driving adoption outside direct-to-consumer web sales. The introduction of hardware-level surveillance implants into the supply chain forces manufacturers to weigh the revenue generated by regional distributors against the catastrophic liability of a single intercepted shipment.