Trezor is shrinking its reseller network. The company says none of its devices have been compromised.
The decision comes after Ledger confirmed that hardware wallets sold through CryptoBilis contained hidden implants. CryptoBilis is a Southeast Asian reseller that also carried Trezor products, and on-chain investigators have linked the case to more than $86 million in drained funds. Trezor dropped CryptoBilis from its own reseller list on October 12 and is now making wider cuts to its distribution network.
In a post on X at 13:32 UTC on October 13, 2026, Trezor said it had decided to reduce the number of resellers “so we can more effectively check those we work with.” A letter to partners signed by Chief Commercial Officer Danny Sanders said authorizations for the affected resellers will end on January 1, 2027.
What Trezor Told Its Resellers
Sanders shared the letter on X two minutes before the company’s post. It tells affected partners, “If you are receiving this letter, your authorization ends on 1 January 2027.” On that date, Trezor will remove them from its list of authorized resellers.
Sanders wrote that Trezor reviewed every country separately, weighing revenue and distribution against the company’s own presence in each market. The letter says the decision “is not a verdict on your business or on the safety of the devices you sell.” It says the decision comes down to how many partners Trezor can check closely.
From the date of the letter, Trezor will ship no new stock to affected resellers. Those partners can keep selling their remaining inventory until January 1, a period the letter notes covers Black Friday and the holiday season.
The letter refers to “the recent supply-chain attack on another hardware wallet brand” without naming Ledger. Sanders wrote that a hardware wallet is only as safe as the path it travels to reach its owner. He added that every device passing through hands Trezor cannot properly check and puts someone’s savings at risk.
For partners that stay, Sanders said Trezor is bringing in an updated legal framework and closer checks on how devices are sourced, stored, and handled. The letter says Trezor will review the decision “if things change in the future.” When he shared it, Sanders wrote, “To the resellers who helped build Trezor: thank you, and I’m sorry.”
Trezor has not said how many resellers are affected or which countries will lose authorized partners.
The CryptoBilis Case at Ledger
Reports of drained wallets among customers in Southeast Asia began circulating on October 9. CryptoBilis is a Kuala Lumpur-based reseller serving Indonesia, Malaysia, and the Philippines. Ledger said that day it had asked CryptoBilis to pause all sales and shipments of Ledger devices.
In a post at 17:09 UTC on October 10, Ledger confirmed that one affected user’s device contained an unauthorized hardware implant. Ledger said it had no indication that its own security infrastructure, systems, or services had been compromised. It also said CryptoBilis had stopped selling all of its hardware wallet inventory until the investigation ended.
On October 13, Ledger published further findings from its Donjon security team. According to the company, the implants used a microcontroller to read the 24-word recovery phrase shown on screen during setup, then sent it out over LTE through an eSIM. Ledger said the implants did not compromise the devices’ secure chips or alter transactions.
Ledger has not confirmed a total loss. Pseudonymous on-chain investigator Specter estimated losses could exceed $86 million. Blockchain data firm Bitquery estimated about $92.9 million drained from 311 wallets, roughly $70.5 million of it from wallets on the Tron blockchain.
Ledger has told CryptoBilis customers not to set up devices they have not already set up. It has told users of devices already in use to move their funds to a new wallet with a newly generated recovery phrase.
Trezor’s Earlier Response to CryptoBilis
CryptoBilis also sold Trezor devices. In a reply on X on October 12, Trezor said it had removed CryptoBilis from its reseller list as a precaution. It said it had received no reports of tampered Trezor devices sold by the reseller.
In a reply under its October 13 announcement, Trezor said orders from its official e-shop ship through fulfillment centers listed on its support site. It repeated that it had no indication any Trezor devices were affected.
Tampering Reports Reach European Retail
Reports of tampered devices have now spread beyond Southeast Asia. European electronics retailer MediaMarktSaturn has pulled Ledger hardware wallets from its stores and online platforms. The move came after an X user, Johannes, reported finding an LTE module and extra cabling inside a Ledger Nano X he bought in person at a MediaMarkt store in Europe. In an October 12 update, he said a second device, bought the same day at a different MediaMarkt location, had identical modifications.
Ledger said MediaMarktSaturn stopped selling its devices after one customer in Germany reported a similar implant. It added that no fund losses have been reported in connection with that case. Ledger has said all verified fund losses from the October 9 incident involve devices sold through CryptoBilis.
Separately, former Mt. Gox CEO Mark Karpelès reported finding a hidden implant in a Ledger Flex bought from a Metapod store at Singapore’s Changi Airport. Ledger has not publicly confirmed a link between that device and the CryptoBilis case.
Trezor’s Separate ShipMonk Data Exposure
The reseller cuts come after a separate data incident at Trezor’s logistics provider. In August 2026, Trezor disclosed that a breach at ShipMonk had exposed the personal data of 13,689 customers. For most of them, the data included names, email addresses, phone numbers, and shipping addresses. ShipMonk told customers that an unauthorized party had exploited a vulnerability in Metabase, a third-party analytics platform.
Trezor said at the time that its own systems were not compromised and that customers’ devices were still secure. That incident involved customer contact data, not device hardware.
What Trezor Has Not Disclosed
Trezor has not published how many resellers are losing authorization, which markets are affected, or the terms of the updated legal framework for partners that stay. It has also not said whether it plans hardware-level changes, such as new tamper-evident packaging or added authenticity checks.
Also Read: S&P Dow Jones Indices, Kaiko Enable First On-Chain OTC Swap Tied to Tokenized Benchmark
