Trezor trims its reseller network after Ledger implant reports

Hardware wallet maker Trezor is cutting the number of shops allowed to sell its devices, calling it a "preventive step, taken out of an abundance of caution" after a supply-chain attack hit buyers of rival Ledger wallets.

What Trezor announced

• In a post on X on Tuesday, Trezor said there is "not a single piece of evidence" that its own devices have been compromised.
• Chief commercial officer Danny Sanders said certain resellers have been told they will be removed from Trezor's authorised list on 1 January, and that shipments to them stop immediately.

Why now

Days earlier Ledger confirmed that devices sold by CryptoBilis, a reseller in Southeast Asia, contained an unauthorised hardware implant that captured recovery phrases and sent them out over a mobile network. On-chain researchers have estimated losses of $72 million to $86 million; Ledger says it has not confirmed the total.

A Trezor spokesperson told Cointelegraph that its setup checks are designed to catch counterfeit devices and modified firmware, but the CryptoBilis implant works differently: it reads what is shown on screen rather than changing the firmware. Trezor says it has not seen this type of attack on its own devices.

CryptoBilis — which was also an authorised Trezor reseller — has suspended all hardware wallet sales, and European retailer MediaMarkt's parent company has pulled Ledger products from its stores and website as a precaution.

Trezor's advice

• Buy directly from the manufacturer and check that the seal is intact.
• Consider a multisignature setup using devices from different makers, so one compromised device cannot move funds alone.