Following a series of hardware-implant attacks on rival Ledger, Trezor announced it will terminate several authorized reseller partnerships on Jan. 1, 2027, as part of a preemptive supply-chain restructuring.
Trezor Trims Authorized Reseller Network
In an Oct. 13 letter, Trezor Chief Commercial Officer Danny Sanders informed partners that selected retailers will lose their authorization status on Jan. 1, 2027. While Trezor stated it found no evidence of compromised units within its own distribution chain, Sanders noted that the manufacturer could no longer inspect every partner in its existing network, writing that "a hardware wallet is only as safe as the path it travels to reach its owner."
Affected resellers will receive no additional inventory but are permitted to liquidate existing stock through the Black Friday and Christmas shopping seasons before being removed from Trezor's authorized retailer directory. Sanders emphasized that the decision "is not a verdict on your business or on the safety of the devices you sell," acknowledging the potential financial impact on small vendors. Remaining authorized partners will face stricter contractual obligations and additional physical inspections covering device sourcing, storage, and handling.
Ledger Hardware Implants Drive Industry Fallout
The defensive pivot follows Ledger's disclosure on Oct. 10 that attackers inserted rogue electronic components into devices distributed by CryptoBilis, an official reseller operating in Southeast Asia. Investigated by Ledger's Donjon security team, the unauthorized implant intercepted 24-word recovery phrases during setup and transmitted them via an embedded eSIM over an LTE connection, operating independently of the device's Secure Element and operating system.
The scope of potential supply-chain compromises has expanded beyond CryptoBilis. On Oct. 13, MediaMarktSaturn suspended all retail and online sales of Ledger hardware wallets across Germany following a report of an implanted device. Furthermore, former Mt. Gox chief executive Mark Karpelès reported discovering a spying implant inside a Ledger Flex purchased from a MetaPod outlet at Singapore's Changi Airport, while CryptoQuant analyst Darkfost flagged a reportedly tampered Ledger Flex bought from Challenger's VivoCity store in Singapore. Independent blockchain investigators estimate cumulative stolen funds near $93 million tied to the incident, prompting Trezor's preemptive supply chain overhaul.
Key Takeaways
- Trezor will revoke authorization for select resellers on Jan. 1, 2027, while allowing inventory liquidation through the upcoming holiday season.
- Ledger confirmed rogue eSIM LTE implants captured 24-word recovery phrases from CryptoBilis inventory without altering normal transaction signing.
- MediaMarktSaturn suspended Ledger sales in Germany, while unconfirmed device implant reports surfaced at MetaPod and Challenger outlets in Singapore.
- On-chain investigators estimate suspected losses reaching $93 million connected to the broader supply-chain exploit.
Why It Matters
This incident represents a structural shift in hardware wallet risk management, forcing companies to address physical supply-chain integrity alongside cryptographic software security. If retail intermediaries can be intercepted to install silent cellular implants, consumer trust in third-party crypto distributors is severely damaged. Expect hardware manufacturers to shift toward direct-to-consumer delivery models while implementing factory-level anti-tamper hardware checks.
