Key facts
- Trezor is ending reseller authorization on January 1, 2027.
- Ledger confirmed a spy implant in crypto wallets sold by reseller CryptoBilis.
- The implant captures recovery phrases from the screen and transmits them via LTE.
- Trezor stated there is no evidence its devices were compromised.
- Onchain investigator Specter traced over $86 million in suspected thefts.
Trezor announced on Tuesday that it is reducing its network of authorized resellers, with current authorizations set to end on January 1, 2027. This decision follows an investigation by rival hardware wallet manufacturer Ledger, which confirmed a hidden spy implant in crypto wallets sold through a third-party store.
Trezor stated that there is "not a single piece of evidence" that its own devices have been compromised, describing the move as a precautionary step to protect its supply chain and customers. The company's Chief Commercial Officer, Danny Sanders, shared a letter to affected providers indicating their authorization would cease on the specified date, and they would receive no new stock.
Ledger's Donjon security team reported that wallets sold by CryptoBilis, a reseller in Southeast Asia, contained an unauthorized component. This implant reportedly reads the screen and decodes the 24-word recovery phrase when it appears, sending the information over LTE via an eSIM. Ledger stated the implant does not alter the core security chip or operating system, meaning tampered wallets appear to function normally.
Onchain investigator Specter traced over $86 million in suspected thefts linked to these compromised wallets, a figure Ledger has not yet verified. Trezor's decision to reduce resellers is intended to allow for more effective vetting of those remaining. Affected resellers can continue selling existing stock through the holiday season. Trezor previously warned in May 2022 about counterfeit Model T wallets sold by an unauthorized seller on a Russian marketplace.