Trezor announced it will reduce the number of its authorized resellers as a precautionary measure following revelations of hardware tampering on a competitor’s devices.
Ledger breach triggers industry alarm
A Southeast Asian reseller, CryptoBilis, sold Ledger hardware wallets that contained an unauthorized implant. The component captured users’ recovery phrases and relayed them via a cellular connection, potentially exposing millions of dollars in crypto assets. Ledger confirmed the incident but has not disclosed the exact number of affected customers or total losses, though independent researchers estimate the hit could range from $72 million to $86 million. In response, the European retailer MediaMarkt removed all Ledger products from its stores and online catalog as an extra safeguard.
Trezor’s pre-emptive actions
Trezor stated that, while it has found no evidence of compromise in its own devices, it will nevertheless tighten its supply chain. Chief Commercial Officer Danny Sanders said the company will notify specific resellers that they will be dropped from the authorized list effective Jan. 1, and that shipments of Trezor units will be halted starting the following Tuesday. The move is described as an “abundance of caution” given recent supply-chain incidents.
How Trezor’s security checks differ
According to a Trezor spokesperson, the firm’s verification process is designed to detect counterfeit hardware and altered firmware. The Ledger implant, however, operates without modifying firmware; it reads screen data and forwards it to an attacker. Trezor has not observed this exact attack vector on its products in the wild, and its current safeguards are not aimed at this specific method.
Guidance for wallet owners
During the investigation, CryptoBilis suspended all hardware-wallet sales. Trezor’s team now recommends that users purchase devices directly from the manufacturer, verify that the product seal remains intact, and consider employing a multisignature arrangement that incorporates wallets from multiple vendors. Such a strategy would prevent a single compromised device from moving funds on its own.
Why it matters
The incident underscores the vulnerability of hardware wallets to supply-chain manipulation, a threat that can bypass traditional firmware-based defenses. By tightening its reseller network, Trezor aims to protect its brand reputation and restore user confidence, while the broader crypto community is reminded to scrutinize purchase channels and diversify security measures. The episode may prompt other hardware manufacturers to reassess their distribution models and reinforce anti-tampering protocols, influencing the overall resilience of crypto custodial solutions.
