Trezor will end some reseller authorizations on January 1, 2027 to focus on partners it can vet closely
Trezor will end its resellers' authorization on January 1, 2027, days after Ledger found an LTE spy implant in wallets sold by CryptoBilis. Trezor says there is no evidence its own devices were compromised.
The Investor · Invest desk
Three separate figures. 80,689 Trezor customers whose data ShipMonk exposed, per Trezor's September update. 90 days: Ledger told CryptoBilis buyers from that window not to set up. More than $86 million in suspected thefts traced by Specter, not verified by Ledger.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Trezor customers whose data ShipMonk exposed | 80,689 customers | Per Trezor's September update | 17 |
| Ledger: CryptoBilis buys in the past | 90 days | Told not to set up their device | 18 |
| Suspected thefts traced by Specter, more than | $86,000,000 | Ledger says it has not verified it | 20 |
What happened
- Ledger's Donjon team says the unauthorized component reads the screen, decodes the recovery phrase when it appears, and sends the words out over LTE through an eSIM.
- Specter, an onchain investigator, put suspected thefts at more than $86 million. Ledger says it has not checked that number.
- Affected resellers get no new stock but can keep selling what they hold through Black Friday and the holiday season.
- In August, shipping partner ShipMonk exposed Trezor customer data, and Trezor's September update put the total at 80,689 customers.
Why it matters
- What it limits constraint Ledger says the implant leaves the key chip and the operating system unaltered, so a tampered wallet looks and works normally and a buyer's only control is where the unit came from.
- What it costs cost The cost falls first on resellers, who lose supply after the holidays, and then on Trezor, which weighed revenue and distribution against its own presence country by country and chose to give up some of that revenue.
- What doesn't add up contradiction Trezor's 2022 advice named authorized resellers as one of two places to buy. Sanders now says the cut reflects how many partners Trezor can vet closely. The safety of that channel now depends on the length of the list.
- Who's exposed exposure A buyer who finishes set-up on a tampered unit hands over the whole balance, because whoever holds the 24-word phrase can empty the wallet from anywhere.
Next story · Invest · yesterday
Bitquery counts $102 million drained from 324 Ledger-linked wallets across six chainsConfirmed6 publishers
Trezor frames the cut as a preventive step taken out of caution [14]. Its post gave the reason in one sentence: "Following recent supply-chain incidents, we decided to reduce the number of resellers so we can more effectively check those we work with," Trezor wrote [5].
The letter to the affected resellers is gentler. Trezor CCO Danny Sanders shared it, and it reads: "I am sorry. This decision says nothing about your effort or the way you represented us." [6] The resellers that remain will work under a revised legal framework, with stricter requirements for sourcing, storing and handling devices [13]. Neither the post nor the letter says how many resellers are affected [12].
Count the incidents in the account and they do not show that supply chain is now the main self-custody risk. Of the three (the 2022 counterfeits, the ShipMonk exposure, the CryptoBilis implant), two involved altered hardware [19]. In both hardware cases Trezor places the seller outside its authorized list: the counterfeit Model T wallets of May 2022 were sold on a Russian marketplace by a seller that was not an authorized reseller [15], and Trezor said CryptoBilis had already dropped off its list of sellers and that it had not received a single report of a tampered Trezor sold by that retailer [9].
We think buying from the maker is sound procedure, and Ledger's own instructions show why. Ledger advised anyone who had bought from CryptoBilis within the last 90 days to leave the device unset, and anyone who had already set one up to move funds to a new seed phrase on a device bought from Ledger [18]. We do not think three incidents support the larger claim. They show where tampering got in, and ranking supply chain against other ways to lose a wallet would take loss counts by cause. The counter-thesis has some force. Trezor is giving up reseller sales on a precaution, and a vendor that does that has judged the risk of tampering to cost more than the sales it loses.
If nothing further surfaces before January 1, the cut stays a precaution with no demonstrated failure behind it. If a tampered unit is traced to a surviving authorized reseller or to Trezor's own store, the shrunken list was not enough and the buy-direct advice fails with it.
What to watch
- Whether Trezor names the number of resellers and the countries affected before the January 1, 2027 cutoff.
- Whether Ledger verifies Specter's loss tracing or publishes its own count of victims.
- Whether Trezor publishes the updated legal framework and sourcing, storage and handling rules for the resellers that stay.
Information, not investment advice. This story is general information about companies and markets, drawn from cited reporting. It is not a recommendation to buy, sell or hold any security; check the cited sources before acting.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+12
- Incentives60
- Confidence66
Perspective Coverage
7 publishers- Builder
- Builder 24%
- Operator
- Operator 47%
- Investor
- Investor 29%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Trezor told partners their reseller authorization ends January 1, 2027, and that it will ship them no new stock.
- [2]
Ledger's Donjon team says wallets sold by CryptoBilis, a reseller in Southeast Asia, contained an unauthorized component that reads the screen and decodes the recovery phrase when it appears, then sends the words out over LTE through an eSIM built into the hardware.
- [3]
Ledger says the implant does not alter the chip that stores the keys or the device's operating system, so a tampered wallet looks and works normally.
- [4]
Trezor said on X that "there is not a single piece of evidence" that Trezor devices have been compromised.
- [5]
Trezor wrote: "Following recent supply-chain incidents, we decided to reduce the number of resellers so we can more effectively check those we work with."
- [6]
The letter Trezor CCO Danny Sanders shared reads: "I am sorry. This decision says nothing about your effort or the way you represented us."
- [7]
Affected resellers will get no new stock, but they can keep selling what they have through Black Friday and the holiday season.
- [8]
Trezor says it reviewed each country on its own, weighing revenue and distribution against its own presence there.
- [9]
Trezor said CryptoBilis was already off its seller list and that it had received no reports of tampered Trezors from the retailer.
- [10]
Setting up a hardware wallet produces a 24-word recovery phrase that works as a master password: whoever has those words can empty the wallet from anywhere in the world.
- [11]
Sanders said the decision reflects how many partners Trezor can vet closely itself.
- [12]
Neither the Trezor post nor the letter says how many resellers are affected.
- [13]
Resellers who stay will face an updated legal framework and tighter rules on how devices are sourced, stored and handled.
- [14]
Trezor described the cut as a preventive step taken out of caution.
- [15]
In May 2022, Trezor warned that counterfeit Model T wallets were being sold on a Russian marketplace by a seller that was not an authorized reseller; the devices had been opened, resealed and fitted with replaced internal components, and the recovery phrases they generated were predictable or predefined.
- [16]
In 2022 Trezor's advice was to buy only from its official shop or an authorized reseller.
- [17]
In August, shipping partner ShipMonk exposed Trezor customer data after unauthorized access, and Trezor's September update put the total at 80,689 customers; Trezor says its systems, devices, private keys and wallet backups were not affected.
- [18]
Ledger told anyone who bought from CryptoBilis in the past 90 days not to set up their device, and told those who already did to move their funds to a new seed phrase on a device bought from Ledger.
- [19]
Of the three incidents in the account (the 2022 counterfeit Model T wallets, the August ShipMonk data exposure, the CryptoBilis implant), two involved altered hardware.
- [20]
Onchain investigator Specter traced more than $86 million in suspected thefts, a figure Ledger says it has not verified.
Sources
7 independent publishers whose own reporting we read for this story.
- cointelegraph.comTrezor reduces resellers as a ‘preventative step’ amid Ledger tampering reports
1 article · October 13, 2026
- crowdfundinsider.comTrezor Cuts Resellers After Ledger CryptoBilis Hardware Wallet Implant Reports
1 article · October 14, 2026
- cryptobriefing.comTrezor trims its reseller network after supply-chain scares
1 article · October 13, 2026
- cryptopolitan.comTrezor is ending authorization for an unnamed group of resellers by January 1, 2027
1 article · October 13, 2026
- cryptoslate.comLedger’s crypto wallet implant scare triggers Trezor reseller crackdown as security fears spread
1 article · October 13, 2026
- decrypt.coTrezor Cuts Its Resellers After Ledger Finds Spy Implant in Crypto Wallets
1 article · October 13, 2026
- news.bitcoin.comTrezor Slashes Reseller Network After $93M Ledger Security Scare
1 article · October 13, 2026
Topics and entities
Topics
- Crypto self-custody
- Hardware Wallet Security
- Software supply chain attacks