Hardware wallet maker Trezor will remove certain resellers from its list of authorized entities starting Jan. 1 and has already halted device shipments to them, a step the company framed as preventative following tampering reports involving competitor Ledger.

Chief Commercial Officer Danny Sanders said he had notified the affected resellers directly. Trezor announced the move in a Tuesday post on X, describing it as a "preventive step, taken out of an abundance of caution" and citing "recent supply-chain incidents" as the trigger.

The company was explicit that the decision does not reflect a breach of its own products. Trezor said there was "not a single piece of evidence that [its] devices have been compromised."

The timing matters. Days earlier, Ledger confirmed that at least one device purchased through a Southeast Asian reseller contained an unauthorized hardware implant. Wallets sold by reseller CryptoBilis captured users' recovery phrases and transmitted them over cellular networks, a mechanism that could expose the full contents of a wallet to an attacker.

How much in user funds was lost?

The loss picture remains unresolved. Research from two independent on-chain investigators suggests between $72 million and $86 million in user funds may be at stake. Ledger said on Tuesday it had "not confirmed the total number of affected users or the total value lost" from the breaches.

For context, the lower estimate alone would place this incident among the largest hardware wallet supply-chain compromises on record — losses that did not require a protocol exploit, a smart contract flaw or a private key breach in the conventional sense. The attack surface was the retail channel itself.

The fallout has already spread beyond the two manufacturers. CryptoBilis, which is also an authorized Trezor reseller, suspended all hardware wallet sales during the investigation. The parent company of European electronics retailer MediaMarkt removed all Ledger products from its physical stores and online platforms "as a precautionary measure."

Why the implant evaded standard checks

Trezor's engineering assessment explains why conventional protections failed. "Our setup checks are built to catch counterfeit devices and modified firmware," a Trezor spokesperson told Cointelegraph. "The implant found in a device bought from CryptoBilis works differently."

The spokesperson continued: "This is a unique way of tampering with the device, which doesn't modify the firmware, but reads information on the screen and later sends it to the attacker. So far, we have not seen this specific type of attack on Trezor devices in the real world."

That distinction carries operational weight for practitioners. Firmware attestation and genuine-device checks — the standard verification layer for hardware wallets — do not detect a hardware implant that reads the device screen directly. A wallet can pass every authenticity test and still exfiltrate a recovery phrase.

What does this change for hardware wallet buyers?

The practical question for users is what actually reduces risk now. Trezor's spokesperson advised buying directly from the manufacturer, checking that the seal is intact, and considering a multisignature wallet "with devices from different makers, so one compromised device can't move funds on its own."

That last recommendation is the structural one. A multisig arrangement across vendors means a single compromised device cannot unilaterally move funds — converting a catastrophic single point of failure into a survivable event.

For Trezor, the commercial consequence is a smaller distribution footprint as of Jan. 1. For the broader market, the episode puts reseller channels under scrutiny that manufacturers can no longer treat as trusted by default, and regulators across jurisdictions may soon follow.