Trezor Cuts Reseller Authorizations From January 1, 2027 After Supply-Chain Incidents

Trezor Slims Its Reseller Network

Trezor is cutting the number of resellers authorized to sell its hardware wallets, a move the company announced on X on Tuesday and framed as a preventive step taken after “recent supply-chain incidents.” The decision, which landed four days after rival maker Ledger opened an investigation into drained wallets, did not say how many partners are being dropped, name any of them, or set a date in the post itself. A smaller sales network, Trezor argued, allows it to “more effectively check those we work with.” The company was explicit about its own hardware, saying it sees “not a single piece of evidence” that any Trezor device has been compromised, and it described the cut as “a preventive step, taken out of an abundance of caution.” It also thanked departing partners for “years of work putting Trezor in people’s hands.” The post left open the questions readers will ask first: how many intermediaries lose access, in which countries, and on what schedule. Those details emerged instead through a separate letter to affected distributors and through a reply the company posted the day before.

@Trezor · X post

Announced on X.

View on X

The CryptoBilis Implant

The backdrop is a hardware implant with an unusually direct attack path. Ledger confirmed that devices sold through CryptoBilis, a reseller operating in Southeast Asia, carried a hidden chip. According to the security update from Ledger’s team, the implant reads the 24-word recovery phrase, the string that functions as the wallet’s master private key, off the device screen during setup, then transmits it out over a cellular connection. On-chain analysts at Bitquery put suspected losses above $93 million, with other tracking estimates running to more than $103 million; Ledger has not confirmed a total. Every case the company has confirmed traces back to CryptoBilis, and on Oct. 9 Ledger asked the reseller to pause sales and shipments of its devices. It later said one affected user’s device contained an unauthorized hardware implant. Users have claimed tampered units reached Europe as well, a claim Ledger has not verified. Beyond its own investigation, Ledger has called for shared anti-tamper standards covering all wallet makers.

January 1, 2027 Cutoff

The mechanics of the cut are more specific than Tuesday’s post. Trezor confirmed in a reply on X on Monday that CryptoBilis had already been removed from its reseller list and that sales through the intermediary had stopped, adding that it has “no reports of tampered Trezors” connected to that channel. In a letter to affected distributors, Chief Commercial Officer Danny Sanders wrote that they lose their authorization on January 1, 2027. New stock shipments to them have already stopped, though they can keep selling inventory they hold through Black Friday and the holiday period. Trezor has not disclosed how many partners are affected or in which regions; Sanders said each country was assessed on revenue, distribution and Trezor’s own reach there. Partners who stay face an updated legal framework and closer checks on how devices are sourced, stored and handled. The company’s caution also has internal precedent: in August it disclosed unauthorized access at shipping provider ShipMonk, a September update raised the count of affected customers to 80,689, and a separate September breach at email provider Brevo exposed roughly 347,000 newsletter addresses that attackers then used for phishing. In both cases Trezor said its wallets and systems were untouched.

@Trezor · X post

In a reply on X on Monday.

View on X

From Device to Distribution Channel

The load-bearing documents here are Trezor’s own posts and disclosure blog, and together they describe a shift of the security perimeter from the device to the sales channel. An implant that captures the recovery phrase during setup defeats the core promise of cold storage, which means the security threats facing hardware wallets now extend from firmware to freight and resellers. Trezor’s cut is deliberately unquantified, and that leaves the burden of proof with the company: publishing vetting criteria for the partners it kept would be the test of whether the exercise was more than a press line. The parallel breaches at ShipMonk and Brevo, which touched customer data rather than devices, show vendor risk reaching well beyond the point of sale. Ledger’s call for shared anti-tamper standards is the open question; no wallet maker has signed on yet.