By Elena Vasquez

Trezor will terminate the authorizations of a portion of its reseller network on January 1, 2027, the Czech hardware wallet maker told partners in a letter, days after rival Ledger confirmed a spy implant in devices sold through a third-party Southeast Asian retailer. Trezor says no evidence shows its own devices were compromised. The claim is plausible; it is also unverified by any party outside the company.

The company announced the move on X and framed it as precaution. "Following recent supply-chain incidents, we decided to reduce the number of resellers so we can more effectively check those we work with," Trezor wrote. Reducing the surface it must audit is a rational control; it also narrows the distribution channel the company has spent years promoting as safe.

What did Ledger's investigation actually find?

Ledger's Donjon security team says wallets sold by CryptoBilis, a reseller operating in Southeast Asia, contained an unauthorized component that reads the device screen and decodes the recovery phrase when it appears. The implant then transmits the words over LTE — the same mobile data standard used by consumer phones — through an embedded eSIM.

According to Ledger, the component does not touch the secure element that stores private keys or the device operating system. A tampered wallet therefore looks and behaves normally, which is precisely what makes the attack difficult for an ordinary buyer to detect.

Onchain investigator Specter traced more than $86 million in suspected thefts linked to the scheme. Ledger says it has not verified that figure. An unverified number, however directionally useful, should not be treated as a loss total.

What changes for resellers and customers?

Trezor CCO Danny Sanders published the letter sent to affected partners. "If you are receiving this letter, your authorization ends on 1 January 2027. On that date we will remove you from our list of authorized Trezor resellers," the letter reads. "I am sorry. This decision says nothing about your effort or the way you represented us."

Sanders added: "This is a precautionary measure to protect our supply chain and our customers. If things change in the future we will review it." A review clause is not a reversal; resellers should plan on the exit being final.

Affected partners will receive no new stock but may sell existing inventory through Black Friday and the holiday season. Neither the public post nor the letter states how many resellers are affected. Trezor says it evaluated each country individually, weighing local revenue and distribution against its own direct presence, and that remaining resellers will operate under an updated legal framework with tighter rules on sourcing, storage, and handling. Tighter rules are welcome; they also imply the prior rules left room for the current risk.

Trezor stated earlier this week that CryptoBilis was already removed from its seller list and that it had received no reports of tampered Trezor devices from that retailer.

Is there a pattern here?

This is not the first supply-chain incident attached to the brand's name. In May 2022, Trezor warned that counterfeit Model T wallets were sold on a Russian marketplace by an unauthorized seller. Those devices had been opened, resealed, and fitted with replaced internals, and Trezor said their recovery phrases were predictable or predefined — meaning a third party could already know the words. Trezor's advice then was to buy only from its official shop or an authorized reseller. The second half of that guidance describes the network it is now shrinking.

In August, shipping partner ShipMonk exposed Trezor customer data through unauthorized access. Trezor's September update put the figure at 80,689 customers. The company says its systems, devices, private keys, and wallet backups were unaffected — a claim about internal integrity that does not undo the exposure of customer records at a third party.

Ledger has advised anyone who bought from CryptoBilis in the past 90 days not to initialize their device, and anyone who already did to migrate funds to a fresh seed phrase on hardware bought directly from Ledger.

The operational takeaway is plain: hardware trust now depends on the entire logistics chain, not the chip alone. Resellers losing authorization on January 1, 2027, and buyers holding devices from unverified channels, both face a hard deadline.