Trezor announced on X that all reseller authorizations will end on January 1, 2027, as a precautionary measure following the Ledger supply chain incident. Trezor CCO Danny Sanders wrote in a letter to partners: ‘This decision does not reflect on your efforts or how you have represented us.’ The preventative move was made to close intermediary loopholes before third parties have the chance to manipulate their hardware.
Cellular Implants and Ledger Hardware Modifications
Trezor’s move follows revelations concerning its primary competitor. Ledger confirmed that wallets sold by CryptoBilis, a reseller in Southeast Asia, contained covert implants. The foreign module inside the circuitry was designed to read the physical screen and transmit users’ 24-word recovery phrases directly to third parties via eSIM or LTE transmission.
The fallout from the attack on Ledger devices has been significant: on-chain tracking recorded losses between $94 million and $102 million. Trezor had already removed CryptoBilis from its official reseller list before announcing the network-wide termination. Trezor emphasized there is ‘not a single piece of evidence’ that Trezor devices have been compromised.
Fate of Retail Inventory and Country-by-Country Re-evaluation
Retailers whose authorizations are being revoked are still permitted to sell through remaining stock until after Black Friday and the year-end holiday shopping season. However, Trezor will no longer supply new units to the intermediary network.
Once authorizations are fully phased out in early 2027, Trezor stated it will review each country individually, weighing revenue generation and distribution efficiency against establishing a direct local presence. Resellers retained in the future will face a new legal framework and significantly stricter rules regarding procurement, storage, and physical device handling.
History of Physical Tampering and Unauthorized Access
Third-party vendor supply chain vulnerabilities are nothing new for Trezor. Last August, shipping logistics partner ShipMonk exposed data belonging to 80,689 Trezor customers following unauthorized access. Trezor confirmed that its internal systems and hardware devices were not affected by the breach.
A history of physical tampering surfaced as far back as May 2022, when Trezor warned of counterfeit Model T wallets circulating on Russian marketplaces. Those clone units had been opened, resealed, and had their recovery phrases pre-programmed by attackers. Trezor’s decision to cut thousands of middlemen proves that in cold wallet security, the most vulnerable failure point is often not software code, but intermediary hands along the delivery route.
Reported via Decrypt.
Previously: Ledger OS Was Never Breached - But CryptoBilis eSIM Implant Stole Recovery Phrases Directly From the Screen
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
