Trezor said it will work with fewer third-party sellers following a series of supply-chain compromises that have already hit rival Ledger and other hardware-wallet makers.
Ledger’s supply-chain breach
Ledger began probing reports from Southeast Asian users who lost funds after purchasing devices from CryptoBilis, a reseller based in Malaysia. The company confirmed that a single device contained an unauthorized hardware component capable of extracting the seed phrase when displayed. Ledger limited the scope of the issue to devices sold through CryptoBilis, noting that the exact number of affected users and the total value taken remain unverified. Independent researcher Specter estimated that roughly $86 million had been siphoned from compromised wallets.
Trezor’s preventive step
In a post on X, Trezor explained that it is reviewing its vendor relationships and will reduce the pool of resellers it supports. The firm emphasized that there is no evidence suggesting any Trezor hardware has been tampered with. The move is described as a precaution taken “out of an abundance of caution.”
A string of hardware-wallet incidents
The Ledger episode follows other recent attacks on hardware wallets. In July, a firmware flaw in Coldcard devices enabled hackers to steal close to $120 million in Bitcoin, according to the device’s maker. Coinkite, the developer behind Coldcard, said the bug produced weak seed generation, allowing attackers to guess seed phrases. Earlier this year, Trezor disclosed that a third-party fulfillment partner suffered a data breach, exposing the personal details of about 81,000 customers. Scammers have also leveraged information obtained through Ledger’s payment processor Global-e to launch phishing campaigns.
Industry response and user guidance
Both hardware-wallet manufacturers have urged users to exercise heightened vigilance. Ledger instructed anyone who bought a device from CryptoBilis not to initialize it and to contact support. Trezor’s decision to shrink its reseller network aims to improve oversight and reduce the risk of future tampering. The incidents underscore the importance of purchasing devices directly from manufacturers or trusted distributors and verifying firmware integrity before use.
Why it matters
Hardware wallets remain a cornerstone of crypto security, yet recent supply-chain attacks highlight vulnerabilities that can undermine user confidence. By tightening reseller relationships, Trezor seeks to protect its brand and customers, while Ledger’s ongoing investigation and public advisories serve as a reminder that even reputable devices can be compromised if the distribution chain is breached. Continued scrutiny of vendor practices and rigorous device verification are likely to become standard expectations for the crypto community.
