Trezor Cuts Reseller Authorizations From January 1, 2027 After Supply-Chain Incidents

Update 22:19 UTC: Trezor added further detail on how the cut will operate.

Trezor Slims Its Reseller Network

Trezor is cutting the number of resellers authorized to sell its hardware wallets, a move the company announced on X on Tuesday and framed as a preventive step taken after “recent supply-chain incidents.” The decision, which landed four days after rival maker Ledger opened an investigation into drained wallets, did not say how many partners are being dropped, name any of them, or set a date in the post itself. A smaller sales network, Trezor argued, allows it to “more effectively check those we work with.” The company was explicit about its own hardware, saying it sees “not a single piece of evidence” that any Trezor device has been compromised, and it described the cut as “a preventive step, taken out of an abundance of caution.” It also thanked departing partners for “years of work putting Trezor in people’s hands.” The post left open the questions readers will ask first: how many intermediaries lose access, in which countries, and on what schedule. Those details emerged instead through a separate letter to affected distributors and through a reply the company posted the day before.

@Trezor · X post

Announced on X.

View on X

The CryptoBilis Implant

The backdrop is a hardware implant with an unusually direct attack path. Ledger confirmed that devices sold through CryptoBilis, a reseller operating in Southeast Asia, carried a hidden chip. According to the security update from Ledger’s team, the implant reads the 24-word recovery phrase, the string that functions as the wallet’s master private key, off the device screen during setup, then transmits it out over a cellular connection. On-chain analysts at Bitquery put suspected losses above $93 million, with other tracking estimates running to more than $103 million; Ledger has not confirmed a total. Every case the company has confirmed traces back to CryptoBilis, and on Oct. 9 Ledger asked the reseller to pause sales and shipments of its devices. It later said one affected user’s device contained an unauthorized hardware implant. Users have claimed tampered units reached Europe as well, a claim Ledger has not verified. Beyond its own investigation, Ledger has called for shared anti-tamper standards covering all wallet makers.

Ledger's own updates added further caution around the numbers. The company said it has "not confirmed the total number of affected users or the total value lost," noting that figures circulating online come from third parties and have not been fully verified, though blockchain investigator Specter put the drain at $86 million. It also advised anyone who bought a device from CryptoBilis not to set it up and to contact its support team instead, and confirmed the reseller has stopped selling devices. More claims of tampered units have surfaced on social media since the investigation began, but Ledger said Tuesday that only devices sold through CryptoBilis have been linked to lost funds so far.

Two adjacent updates sharpen the picture around the cut. In the letter, Sanders apologized directly to the partners being dropped, writing "I am sorry. This decision says nothing about your effort or the way you represented us," and framed the cull as an oversight measure rather than an accusation of wrongdoing by any individual reseller. Separately, Ledger Donjon said the unauthorized chip found in CryptoBilis-supplied wallets captures the 24-word recovery phrase shown during initialization, with its microcontroller decoding the words and transmitting them over LTE through a provisioned eSIM, while the Secure Element, operating system and transaction signing are untouched. Tether has frozen $10 million in USDT tied to the case, and OneKey has also revoked CryptoBilis, offering free replacements to anyone who bought its products there between March 1 and Oct. 12, 2026.

Trezor added further detail on how the cut will operate. The company said the decision should not be read as a judgment of the affected partners' businesses or of the safety of the devices they sold, and it emphasized that channels outside its oversight put users' funds at risk, which is why the network is being reduced to a size every remaining partner can be vetted. Resellers who survive the review face updated legal terms and stricter controls on sourcing, storage and handling, and Trezor is also demanding further measures from everyone across its supply chain, including itself. The company said it will revisit the decision if circumstances change.

January 1, 2027 Cutoff

The mechanics of the cut are more specific than Tuesday’s post. Trezor confirmed in a reply on X on Monday that CryptoBilis had already been removed from its reseller list and that sales through the intermediary had stopped, adding that it has “no reports of tampered Trezors” connected to that channel. In a letter to affected distributors, Chief Commercial Officer Danny Sanders wrote that they lose their authorization on January 1, 2027. New stock shipments to them have already stopped, though they can keep selling inventory they hold through Black Friday and the holiday period. Trezor has not disclosed how many partners are affected or in which regions; Sanders said each country was assessed on revenue, distribution and Trezor’s own reach there. Partners who stay face an updated legal framework and closer checks on how devices are sourced, stored and handled. The company’s caution also has internal precedent: in August it disclosed unauthorized access at shipping provider ShipMonk, a September update raised the count of affected customers to 80,689, and a separate September breach at email provider Brevo exposed roughly 347,000 newsletter addresses that attackers then used for phishing. In both cases Trezor said its wallets and systems were untouched.

@Trezor · X post

In a reply on X on Monday.

View on X

From Device to Distribution Channel

The load-bearing documents here are Trezor’s own posts and disclosure blog, and together they describe a shift of the security perimeter from the device to the sales channel. An implant that captures the recovery phrase during setup defeats the core promise of cold storage, which means the security threats facing hardware wallets now extend from firmware to freight and resellers. Trezor’s cut is deliberately unquantified, and that leaves the burden of proof with the company: publishing vetting criteria for the partners it kept would be the test of whether the exercise was more than a press line. The parallel breaches at ShipMonk and Brevo, which touched customer data rather than devices, show vendor risk reaching well beyond the point of sale. Ledger’s call for shared anti-tamper standards is the open question; no wallet maker has signed on yet.