Trezor reduces resellers as a ‘preventative step’ amid Ledger tampering reports
Hardware wallet maker Trezor announced it will reduce the number of its resellers as a ‘preventative step, taken out of an abundance of caution’ following reports of malicious implants found in competitor Ledger’s devices. Although there is no evidence of compromise of Trezor devices, the company decided to limit distribution by some resellers and urged customers to buy directly from the company to ensure security.
Background of the incident and reason for reducing resellers
Days before Trezor’s announcement, Ledger confirmed that at least one device purchased from a Southeast Asian reseller contained an unauthorized hardware implant. This tampering compromised recovery phrases, risking millions of dollars of user funds.
The reseller CryptoBilis sold wallets with implants that read information from the device’s screen and transmitted it over cellular networks to attackers. A Trezor spokesperson explained that while their setup detects counterfeit devices and firmware modifications, this specific type of hardware attack does not involve firmware tampering and had not been observed on Trezor devices.
Trezor’s preventive measures
In a Twitter post, Trezor asserted there is no evidence that its devices have been compromised. Nevertheless, the company is reducing the number of authorized resellers due to recent supply chain incidents.
Danny Sanders, Trezor’s chief commercial officer, informed certain resellers that they would be removed from the authorized list effective January 1, with shipments stopped immediately.
Trezor urges customers to purchase products directly from the company and verify that seals are intact to ensure the device's security.
Market reactions and impact
Following the discovery, CryptoBilis suspended all hardware wallet sales. European electronics retailer MediaMarkt’s parent company also removed all Ledger products from physical stores and online platforms as a precaution.
Blockchain investigators estimate user losses due to the breach between $72 million and $86 million, although Ledger has not confirmed the exact number of affected users or total losses.
Trezor recommends users consider multisignature wallets combining devices from different manufacturers to prevent a single compromised device from moving funds alone.
Why it matters
Trezor’s decision to reduce its reseller network highlights growing industry concerns about supply chain security in hardware wallets following the Ledger implant breaches. Malicious hardware implants can bypass many traditional safeguards, making control over sales channels and user awareness crucial. By limiting resellers and urging direct purchases, Trezor aims to reduce the risk of compromised devices reaching end users. The recommendation to use multisignature wallets involving devices from multiple manufacturers also reflects the increasing complexity of threats in the crypto space and the need for layered security measures to protect user assets effectively.
Prepared from the source material with AI-assisted editing and checked against the supplied facts.
Open original source ↗