Trezor cuts resellers as Ledger halts sales in seven markets

Trezor will shrink its authorized reseller network on Jan. 1, 2027, days after Ledger confirmed that wallets sold by a Southeast Asian retailer carried a hidden implant that steals recovery phrases.

The company announced the move on X on Oct. 13, saying there is not a single piece of evidence that Trezor devices have been compromised and describing the cut as a preventive step taken out of caution, Decrypt reported. "Following recent supply-chain incidents, we decided to reduce the number of resellers so we can more effectively check those we work with," Trezor wrote. Neither the post nor the letter to partners says how many resellers are affected.

Danny Sanders, Trezor's chief commercial officer, shared the letter sent to departing partners. "If you are receiving this letter, your authorization ends on 1 January 2027. On that date we will remove you from our list of authorized Trezor resellers," the letter reads. "I am sorry. This decision says nothing about your effort or the way you represented us." Cut-off resellers will get no new stock but can sell existing inventory through Black Friday and the holiday season. Trezor says it judged each country on its own, weighing revenue and distribution against its own presence there, and partners that stay will face an updated legal framework with tighter rules on sourcing, storage and handling.

Ledger's Donjon security team says wallets sold by CryptoBilis, a reseller in Southeast Asia, held an unauthorized component that reads the screen and decodes the recovery phrase when it appears, then sends the words out over LTE. The implant leaves the key-storage chip and the operating system alone, so a tampered wallet looks and works normally, according to the Decrypt report. A hardware wallet setup produces a 24-word recovery phrase that works as a master password, so whoever holds those words can empty the wallet from anywhere. Onchain investigator Specter traced more than $86 million in suspected thefts, a figure Ledger says it has not verified.

In May 2022 Trezor warned that counterfeit Model T wallets were being sold on a Russian marketplace by an unauthorized seller, with opened and resealed devices running predictable or predefined recovery phrases. Its advice then was to buy only from its official shop or an authorized reseller, the network it is now shrinking, Decrypt noted. In August a shipping partner exposed Trezor customer data, and a September update put the total at 80,689 customers, with systems, devices, private keys and backups unaffected.

Ledger separately asked resellers and distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to suspend sales and take products off shelves while its investigation continues, the company said in an Oct. 13 post. The only confirmed incidents remain in Southeast Asia, and Ledger says it has not verified a drain linked to a device bought elsewhere. All confirmed losses involve devices sold through CryptoBilis. The company says it has no indication that its own infrastructure, systems, services or direct sales channel have been compromised, and it is still working out who tampered with the devices and at what point in the chain.

Ledger told anyone who bought from CryptoBilis in the past 90 days not to set up the device, and told those who already did to move funds to a new seed phrase on a device bought from Ledger itself.

European retail got pulled in the same day. MediaMarktSaturn removed Ledger products from physical stores and online platforms in every country where it operates, calling it a precaution, a company spokesperson told Cointelegraph. Ledger said the suspension came in coordination with the retailer after a customer in Germany reported an implant, with no fund losses in that case. An X user known as Johannes said Oct. 13 that two Ledger wallets from separate MediaMarkt stores contained unauthorized cables and cellular modules. Separately, former Mt. Gox CEO Mark Karpeles said a Ledger Flex bought at Singapore's airport held a spy implant, and Ledger pointed back to its CryptoBilis investigation update without addressing the Singapore case directly, Cointelegraph reported.