Trezor Cuts Resellers After Ledger Spy Implant Scandal, Ends Authorizations on January 1, 2027

Published October 13, 2026, 22:55 PKT. Based on Trezor's October 13 announcement on X, a partner letter signed by Chief Commercial Officer Danny Sanders, and October 13 reporting by Unchained, Finst, CoinCodex and CryptoTimes.

Hardware wallet maker Trezor said on October 13 it is cutting the number of stores allowed to sell its devices, calling the move a preventive step after "recent supply-chain incidents." The Prague-based company announced the decision on X at 13:32 UTC, saying a smaller reseller network lets it "more effectively check those we work with."

The January 1, 2027 cutoff

In a partner letter signed by Chief Commercial Officer Danny Sanders, Trezor told affected sellers their authorizations will end on January 1, 2027, according to Finst. The company has already stopped supplying new inventory to those partners, but they may still sell their existing stock through the Black Friday and holiday shopping period. Sanders said Trezor reviewed revenue, distribution and its own presence in each country before deciding which resellers to keep. Partners that keep their authorization will get an updated legal framework and stricter checks on the origin, storage and handling of devices.

No evidence Trezor devices were tampered

Trezor stressed that the cut is precautionary. "Let us be very clear: there is not a single piece of evidence that Trezor devices have been compromised," the company wrote on X. A day earlier, on October 12, Trezor told followers on X that CryptoBilis, the Southeast Asian reseller at the center of the Ledger wallet-draining scandal, was off its own reseller list and that Trezor sales through the store had stopped. "We have no reports of tampered Trezors from CryptoBilis," the company wrote. CryptoTimes reported that CryptoBilis had carried Trezor products alongside Ledger devices.

The $93 million trail to CryptoBilis

The scandal behind Trezor's decision began on October 9, when rival Ledger opened an investigation into drained wallets traced to devices sold in Southeast Asia by CryptoBilis, Unchained reported. Ledger confirmed that one affected user's device contained an unauthorized hardware implant. Ledger's Donjon security team later detailed how the implant worked: a hidden microcontroller decoded the user's 24-word recovery phrase from the screen during setup and transmitted it over a mobile LTE connection using an embedded SIM, without touching the device's Secure Element or operating system. On-chain analysts put the losses between about $93 million and more than $103 million, though Ledger has not confirmed a total. CryptoBilis has since suspended sales and shipments of all hardware wallet brands in Malaysia, the Philippines and Indonesia and temporarily closed its physical stores.

ShipMonk and Brevo: Trezor's own vendor scares

Trezor has handled two of its own third-party breaches this year, neither of them involving a reseller. In August it disclosed unauthorized access at its shipping provider, ShipMonk; a September update raised the count of affected customers to 80,689. Also in September, a breach at email provider Brevo exposed about 347,000 newsletter addresses, which attackers then used to send a phishing email. Trezor said its own wallets and systems were not affected in either case.

This article is news reporting and is not investment advice.

Sources

• Trezor, October 13, 2026 announcement on X, primary source for the reseller-network cut, the "not a single piece of evidence" statement and the October 12 CryptoBilis removal
• Trezor partner letter signed by Chief Commercial Officer Danny Sanders, primary source for the January 1, 2027 authorization end date, the halt on new inventory and the updated legal framework for remaining partners
• Unchained, "After Ledger's Reseller Breach, Trezor Pares Back Who Can Sell Its Hardware Wallets" (October 13, 2026), secondary source for the announcement timeline, the $93 million to over $103 million loss estimates and the Ledger investigation background
• Finst, "Trezor Cuts Back on Resellers After Ledger Hack" (October 13, 2026), secondary source for the partner letter details and the January 1, 2027 date
• CoinCodex, "Ledger Confirms Spy Chip Was Planted in CryptoBilis Devices to Leak Wallet Keys" (October 13, 2026), secondary source for the implant mechanism and CryptoBilis' suspension of sales
• CryptoTimes, "Trezor Overhauls Reseller Network After Hidden Ledger Wallet Implants Surface" (October 13, 2026), secondary source for CryptoBilis' sale of Trezor products and Trezor's October 12 removal of the reseller