Hardware wallet manufacturer Trezor is reducing its authorized reseller network following the discovery of malicious implants in Ledger devices sold through third-party distributors, as blockchain investigators raise estimated losses from the CryptoBilis incident to $102 million.
Trezor announced the precautionary changes on October 13, confirming that affected distribution partners will lose their authorization on January 1, 2027. New shipments to those resellers have already stopped.
The company also removed Southeast Asian retailer CryptoBilis from its authorized network after Ledger identified tampered devices distributed through the same business.
Trezor stressed that it has received no evidence of compromised devices bearing its own brand.
Trezor Ends Reseller Agreements Starting January 2027
Chief Commercial Officer Danny Sanders outlined the changes in a letter to distribution partners, explaining that Trezor could no longer maintain the same level of oversight across its existing reseller network.
Affected partners can sell their remaining inventory through the holiday season but will receive no additional stock from Trezor. Their authorization expires at the beginning of 2027.
The company plans to introduce stricter partner verification and updated contractual requirements covering product sourcing, storage and handling.
Sanders emphasized that the decision did not indicate misconduct by the affected resellers. He also publicly thanked longstanding partners and apologized for terminating their commercial relationships.
Trezor has not disclosed how many retailers will lose authorization or which markets will be affected.
Ledger Confirms Recovery Phrase Theft Through Hidden LTE Implants
The changes follow Ledger’s investigation into CryptoBilis-linked wallet drains affecting customers across Southeast Asia.
Ledger’s Donjon security team identified an unauthorized electronic implant concealed inside affected hardware wallets. The component intercepted the 24-word recovery phrase displayed during device initialization and transmitted the information over LTE using an embedded SIM.
The implant operated independently of Ledger’s Secure Element and did not modify its operating system or transaction signatures.
Ledger has confirmed that its investigated cases involved devices sold through CryptoBilis, while maintaining that its internal systems and direct sales channels remain unaffected.
The incident adds a new physical supply-chain dimension to concerns previously raised over Ledger’s security record, which included earlier customer-data breaches and a software supply-chain exploit.
Blockchain intelligence firm Bitquery has since traced an estimated $102 million in stolen assets across 324 wallets on six blockchains, exceeding initial estimates of $86 million.
The investigation identified coordinated withdrawals across Tron, Bitcoin, Ethereum, Solana, BNB Chain and Polygon. Tether also froze approximately $10 million in USDT connected to the suspicious transfers.
Ledger has not independently confirmed the total loss figure.
MediaMarkt Suspends Ledger Sales as Investigation Expands
The investigation has also reached European retailers.
MediaMarktSaturn suspended sales of affected Ledger products following a customer’s report of modified hardware purchased in Germany.
The customer reported finding additional wiring and cellular communication components inside two devices acquired from different MediaMarkt locations.
Ledger acknowledged the German report but said no associated fund losses had been identified. The company has not established a connection between those devices and the CryptoBilis thefts.
Another wallet manufacturer, OneKey, has revoked CryptoBilis’ reseller authorization and offered free replacement devices to customers who purchased its products through the retailer between March 1 and October 13.
Ledger continues to advise CryptoBilis customers against initializing unused devices. Those who already configured affected wallets should transfer their assets to a securely generated wallet with a new recovery phrase.
Trezor’s broader reseller changes will take effect on January 1, 2027, with its revised distribution controls intended to reduce the number of intermediaries handling customer devices.
Be the first to comment