Trezor cuts resellers by Jan. 1, 2027 after Ledger implant findings

Key takeaways
The manufacturer of the Trezor hardware wallet is shrinking its authorized reseller network after a highly publicized security breach at competitor Ledger. Danny Sanders, Trezor's chief commercial officer, said authorization for affected resellers would be revoked on Jan. 1, 2027, as part of a move to take greater control of the supply chain. Trezor stressed the action is precautionary and there is no evidence its devices were compromised. The change follows Ledger's disclosure that devices sold through CryptoBilis in Southeast Asia contained unauthorized hardware implants.

What happened
Trezor's letter to partners said affected resellers would be delisted from the official list of authorized partners on Jan. 1, 2027. New inventory will no longer be sent to those businesses, but they can continue selling remaining stock until the termination date, including through Black Friday and the holiday season.

The announcement came just days after Ledger was implicated in a significant supply chain security scandal. Ledger acknowledged that certain devices sold through the reseller CryptoBilis had unauthorized hardware implants that could intercept users' 24-word recovery phrases when they initialize their devices. Findings published by Ledger's Donjon security team said the malicious implants could send stolen recovery phrases over cellular networks, potentially exposing users to loss of access to cryptocurrency funds. On-chain sleuths estimated the event may have led to losses of more than $90 million, though Ledger has not confirmed that figure; the breach had also been reported to cause tens of millions of dollars in cryptocurrency losses.

Although the step could be read as a sign that the company suspects Trezor devices may be compromised, Sanders said the measure is strictly precautionary. “Let me be very clear: there is not a single piece of evidence that Trezor devices have been compromised,” he wrote. He noted that the hack against another hardware wallet manufacturer reaffirmed pre-existing concerns about risks from third-party distribution. His argument was that even if a hardware wallet is technically secure, hackers can still access the wallet before it ends up with the wallet owner.

Trezor explained that the assessment of each individual market was based on revenue, distribution capabilities, and its already established presence in the market. The company concluded that fewer resellers meant more in-depth security checks could be done. The decision does not reflect poorly on the affected businesses or imply they distributed compromised devices. For authorized partners, Trezor will tighten the contractual agreement and increase control over how devices are obtained, stored, and handled. It did not specify how many resellers would lose authorization.

Market context
The episode shows that hardware wallet security extends beyond the device itself. In Ledger's case, the reported problem involved unauthorized implants inside devices sold through a third-party channel. Because the implants could capture 24-word recovery phrases during initialization and transmit them over cellular networks, the distribution path became part of the attack surface. The user's funds could be exposed before the wallet ever enters ordinary use.

The financial scale remains uncertain. Ledger has not confirmed the $90 million estimate from on-chain sleuths, while earlier reports described losses in the tens of millions. That gap does not weaken the technical warning: the security risk was identified through Ledger's own Donjon team. Trezor's response is different because it has no reported compromise. It is reducing distribution complexity rather than addressing a confirmed Trezor incident.

Why it matters
For resellers, the practical impact is a defined end date and a shrinking official channel. Affected businesses may sell existing inventory through Jan. 1, 2027, but they lose future shipments and authorized status. Remaining partners face tighter contractual controls over acquisition, storage, and handling. The company's stated logic is that fewer resellers allow deeper security checks, even without evidence that current devices are compromised.

For the broader market, this significant restructuring effort shows that in the wake of the Ledger fiasco, hardware wallet manufacturers are questioning the security implications of third-party distribution. The issue is not whether a wallet's software or hardware design is secure, but whether the physical path from factory to customer can be controlled. A technically sound device can still be a target if it can be opened, modified, or intercepted before the owner receives it.

Trezor's wording also matters. By saying the decision does not imply wrongdoing by affected resellers, the company avoids accusing partners while still removing them from the authorized list. That creates a controlled reduction of the network instead of a public fraud investigation.

What to watch
The first open question is scale. Trezor did not specify how many resellers will lose authorization or which markets will be affected most. Because the company said the decision was based on revenue, distribution capabilities, and its established presence, the future list of authorized partners may change unevenly across markets.

The second is implementation. For remaining authorized partners, the company plans to tighten agreements and increase control over how devices are obtained, stored, and handled. Details of those controls are not in the letter. Readers should watch whether the new terms require more direct verification, tighter logistics, or reduced reseller discretion.

The third is whether other manufacturers follow. The source material shows Ledger dealing with a confirmed implant problem through a reseller relationship, while Trezor is acting to limit future exposure. If the Ledger incident changes industry norms, more hardware wallet makers may move toward narrower supply chains, even when they have no evidence of their own compromise.

Finally, the Ledger loss estimate should be treated carefully. On-chain sleuths have estimated more than $90 million, but Ledger has not confirmed the figure. Until a company-confirmed number or further technical disclosure appears, the clearest conclusion is that Trezor is tightening reseller rules because supply chain tampering is now a recognized industry risk, not because Trezor has found its own devices compromised.