Trezor is cutting authorized resellers following a hardware-implant attack against rival Ledger that exposed vulnerabilities in cryptocurrency wallet distribution. Trezor Chief Commercial Officer Danny Sanders said in an Oct. 13 letter that selected partners would lose authorization on Jan. 1, 2027. Trezor said it found no evidence of compromised devices within Trezor's network and described the restructuring as preventive.
Sanders said Trezor could no longer adequately inspect every partner in Trezor's existing distribution network, prompting a review of authorized retailers. Sanders argued that a hardware wallet's safety depends on the distribution path to the owner. Trezor evaluated individual markets based on revenue, distribution coverage and Trezor's ability to reach customers before deciding which partnerships to terminate. Affected retailers will receive no additional inventory but can sell existing stock through the Black Friday and Christmas shopping seasons. Trezor will remove affected retailers from the authorized reseller directory on Jan. 1. Trezor did not disclose how many businesses would lose authorization or which markets would be affected.
Sanders acknowledged that the decision could have significant financial consequences for smaller retailers whose businesses depend on Trezor products. However, Sanders stressed that the restructuring did not reflect wrongdoing by affected partners or concerns about the safety of existing inventory. Trezor plans stricter contractual requirements and additional inspections of how remaining authorized retailers source, store and handle devices. The changes could increase compliance obligations while giving Trezor greater control over inventory before devices reach customers.
Ledger confirmed that attackers installed an unauthorized electronic component inside a wallet sold by CryptoBilis, an official reseller operating in Southeast Asia. Ledger's Donjon security team found that the implant could capture the 24-word recovery phrase displayed during wallet setup. The Donjon team found that the implant could transmit that information through an LTE connection using an embedded eSIM. The component operated separately from the wallet's Secure Element and operating system, allowing attackers to obtain recovery credentials without interfering with normal transaction signing. Ledger confirmed the discovery on Oct. 10. Ledger said all verified thefts connected to the incident involved devices purchased through CryptoBilis. CryptoBilis has since stopped selling Ledger products.
However, investigators are examining reports involving additional authorized retailers. Ledger confirmed on Oct. 13 that MediaMarktSaturn had suspended Ledger hardware wallet sales across physical stores and online platforms following a report of an implanted device purchased in Germany. Ledger said Ledger had not reported any financial losses in connection with the German case. Former Mt. Gox chief executive Mark Karpelès separately reported discovering a spying implant inside a Ledger Flex purchased from a MetaPod outlet at Singapore's Changi Airport. CryptoQuant analyst Darkfost also flagged a reportedly tampered Ledger Flex purchased from Challenger's VivoCity store in Singapore. Ledger has not independently confirmed those findings or linked those findings to the CryptoBilis attack.
Darkfost subsequently expanded a watchlist of authorized retailers across Southeast Asia and Europe based on potential distribution exposure. Darkfost cautioned that inclusion on the watchlist did not establish compromise. The growing number of reports has intensified scrutiny of where devices were modified and whether the incidents share a common distribution channel. Independent blockchain investigators have linked suspected losses approaching $93 million to the broader incident. However, Ledger has not verified the total value stolen or the number of affected customers.
Ledger maintains that Ledger's internal systems and services remain uncompromised. Ledger's Donjon team is examining additional submitted devices to establish the source and extent of the tampering. The source and full extent of the suspected compromise remain unknown.
Trezor Restructures Reseller Network Amid Ledger Hardware Wallet Implant Scandal
CryptoSlateShare
Summary
Trezor is overhauling its reseller network as part of a broader network upgrade following a security breach at Ledger. Ledger confirmed a malicious component was installed in a wallet sold by an authorized reseller, potentially exposing recovery phrases. Trezor’s CCO Danny Sanders said some partners would lose authorization by January 1, 2027. On-chain news suggests growing scrutiny of wallet distribution channels. Ledger has not confirmed the total value stolen, but reports estimate losses near $93 million.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.