Trezor has announced the termination of its authorized reseller network, effective January 1, 2027, following a security investigation by rival manufacturer Ledger that identified spyware implants in hardware wallets sold through third-party channels. Trezor stated on X that there is no evidence its own devices were compromised but described the move as a preventive measure to tighten supply chain controls and improve vetting capabilities. The decision comes after Ledger’s Donjon security team discovered unauthorized components in wallets sold by Southeast Asian reseller CryptoBilis. These implants were designed to capture recovery phrases from the device screen and transmit them via LTE using an embedded eSIM, allowing attackers to access funds without altering the device's core chip or operating system.
While CryptoBilis was already removed from Trezor’s seller list prior to this announcement, the broader restructuring affects all current partners. Affected resellers will cease receiving new inventory immediately but may continue selling existing stock through the holiday season. Trezor Chief Compliance Officer Danny Sanders noted that the reduction allows the company to more effectively monitor remaining partners under updated legal frameworks regarding sourcing and handling. The number of impacted resellers remains undisclosed. This incident highlights ongoing risks in the hardware wallet market, where physical tampering can bypass digital security measures. Ledger has advised customers who purchased from CryptoBilis within the last 90 days to avoid setting up their devices or to migrate funds to new seed phrases on verified hardware.
Trezor’s preemptive dissolution of its reseller network signals a strategic pivot toward direct-to-consumer distribution to mitigate supply chain vulnerabilities exposed by recent incidents. By eliminating intermediaries, the company aims to regain full control over product integrity and customer data, addressing the specific threat vector where physical implants compromise offline key storage. This move underscores the difficulty of maintaining trust in decentralized hardware ecosystems when third-party logistics introduce points of failure that are invisible to standard software audits.
The incident involving CryptoBilis demonstrates that hardware attacks can remain undetected by users if the device functions normally while exfiltrating sensitive data via cellular networks. For the broader crypto industry, this reinforces the necessity for rigorous physical security protocols and transparent provenance tracking. Investors and users must recognize that regulatory compliance and software updates cannot protect against pre-installation tampering, making the source of purchase a critical component of asset security. The shift away from broad reseller networks may increase operational costs for manufacturers but is likely essential for preserving brand credibility in a high-stakes environment.
