Ledger’s crypto wallet implant scare triggers Trezor reseller crackdown as security fears spread

Trezor is cutting authorized resellers after a hardware-implant attack against rival Ledger exposed vulnerabilities in cryptocurrency wallet distribution.

In an Oct. 13 letter, Trezor Chief Commercial Officer Danny Sanders said selected partners would lose their authorization on Jan. 1, 2027, as the company tightens oversight of its supply chain.

The decision marks an escalation in the commercial fallout from the Ledger investigation, which has raised questions about how attackers can introduce malicious components into hardware wallets before they reach customers.

Trezor said it found no evidence of compromised devices within its network, describing the restructuring as a preventive measure.

Trezor sacrifices retail reach for tighter supply-chain controls

Sanders said the company could no longer adequately inspect every partner in its existing distribution network, prompting a review of which retailers should remain authorized. He wrote:

“A hardware wallet is only as safe as the path it travels to reach its owner.”

The company evaluated individual markets based on revenue, distribution coverage, and its ability to reach customers before deciding which partnerships to terminate.

Affected retailers will receive no additional inventory but can continue selling existing stock through the Black Friday and Christmas shopping seasons. Trezor will also remove them from its authorized reseller directory on Jan. 1.

The company did not disclose how many businesses would lose authorization or which markets would be affected.

Sanders acknowledged that the decision could have significant financial consequences for smaller retailers that have built their businesses around Trezor products.

However, he stressed that the restructuring did not reflect wrongdoing by the affected partners or concerns about the safety of their existing inventory. He said:

“This is not a verdict on your business or on the safety of the devices you sell.”

For retailers retaining their authorization, Trezor plans stricter contractual requirements and additional inspections covering how devices are sourced, stored, and handled.

The changes could increase compliance obligations across its remaining distribution network while giving the manufacturer greater control over inventory before it reaches customers.

Ledger investigation raises questions about authorized retail channels

Trezor's decision follows Ledger's confirmation that attackers installed an unauthorized electronic component inside a wallet sold by CryptoBilis, an official reseller operating in Southeast Asia.

Ledger's Donjon security team found that the implant could capture the 24-word recovery phrase displayed during wallet setup and transmit the information through an LTE connection using an embedded eSIM.

The component operated separately from the device's Secure Element and operating system, allowing attackers to obtain recovery credentials without interfering with normal transaction-signing functions.

Ledger confirmed the discovery on Oct. 10 and said all verified thefts connected to the incident involved devices purchased through CryptoBilis, which has since stopped selling its products.

However, investigators are now examining reports involving additional authorized retailers.

On Oct. 13, Ledger confirmed that MediaMarktSaturn had suspended sales of its hardware wallets across physical stores and online platforms following a report of an implanted device purchased in Germany.

The company said it had not reported any financial losses in connection with the German case.

Separately, former Mt. Gox chief executive Mark Karpelès reported discovering a spying implant inside a Ledger Flex purchased from a MetaPod outlet at Singapore's Changi Airport.

CryptoQuant analyst Darkfost also flagged a reportedly tampered Ledger Flex purchased from Challenger's VivoCity store in Singapore.

Those findings have not been independently confirmed by Ledger or linked to the CryptoBilis attack.

Darkfost subsequently expanded a watchlist of authorized retailers across Southeast Asia and Europe based on potential distribution exposure, while cautioning that inclusion did not establish compromise.

The growing number of reports has intensified scrutiny of where the devices were modified and whether the incidents share a common distribution channel.

Independent blockchain investigators have linked suspected losses approaching $93 million to the broader incident, although Ledger has not verified the total value stolen or the number of affected customers.

The manufacturer maintains that its internal systems and services remain uncompromised.

Ledger's Donjon team is examining additional submitted devices as it works to establish the source and extent of the tampering.