Trezor is terminating authorization for selected resellers effective January 1, 2027, citing supply-chain security concerns following Ledger’s discovery of an implanted electronic component inside a wallet sold by CryptoBilis, an official Ledger reseller in Southeast Asia.
Danny Sanders, Chief Commercial Officer of Trezor, announced the reseller cuts in a letter issued October 13. “A hardware wallet is only as safe as the path it travels to reach its owner,” Sanders wrote, signaling that hardware wallet manufacturers can no longer rely on inspection protocols that fail to catch tampering across their entire distribution network.
Ledger’s Donjon security team confirmed on October 10 that an unauthorized electronic component had been inserted into a device sold by CryptoBilis. The implant could capture the 24-word recovery phrase and transmit it via LTE connection using an embedded eSIM, operating independently from the device’s Secure Element and operating system. All verified thefts connected to the CryptoBilis incident involved devices purchased through that reseller, which has since stopped selling products.
Sanders emphasized that the decision does not reflect judgment on individual retailers. “This is not a verdict on your business or on the safety of the devices you sell,” he wrote. Trezor found no evidence of compromised devices within its own network.
Retail Impact and Reseller Response
Affected retailers will receive no additional inventory but may continue selling existing stock through Black Friday and Christmas seasons. MediaMarktSaturn, an authorized Ledger retailer, suspended Ledger hardware wallet sales on October 13 in response to the discovery.
Trezor plans to impose stricter contractual requirements and additional inspections for retained resellers, covering device sourcing, storage, and handling practices. The company did not specify how many businesses will lose authorization or which markets will be affected.
Broader Supply-Chain Questions
Mark Karpelès, former Mt. Gox CEO, and Darkfost, a CryptoQuant analyst, reported discovering implanted devices at Singapore retailers including a MetaPod outlet at Changi Airport and a Challenger store at VivoCity. These findings have not been independently confirmed by Ledger or linked to the CryptoBilis attack. Darkfost flagged a watchlist of retailers with potential exposure but cautioned that inclusion did not establish compromise.
Independent blockchain investigators have attributed $93 million in suspected losses to the broader incident, though Ledger has not verified this figure.
