Hardware wallet maker Trezor is reducing the number of authorized resellers it works with following a security incident involving rival company Ledger. The move is intended to give Trezor better control over how its devices are handled before they reach customers.

In a letter to selected retail partners, Trezor Chief Commercial Officer Danny Sanders said their authorization would end on January 1, 2027. The company has also stopped sending new stock to affected sellers, although they can continue selling their existing inventory during the Black Friday and Christmas shopping seasons.

Trezor said the decision was a precaution and stressed that there is no evidence its own devices have been compromised. “Let us be very clear: there is not a single piece of evidence that Trezor devices have been compromised,” the company said.

Trezor said it wants to work with fewer resellers so it can check them more closely. The company plans to introduce stricter requirements and inspect how its remaining partners source, store and handle devices.

The decision follows reports that criminals installed unauthorized electronic components inside Ledger hardware wallets sold through resellers in Southeast Asia, which has now spread to Europe and South America as well.

“A hardware wallet is only as safe as the path it travels to reach its owner,” Sanders wrote in his letter.

Trezor has not disclosed how many resellers will lose their authorization or which markets will be affected. The company said the changes do not mean that the affected sellers did anything wrong or that their existing stock is unsafe.

Sanders also apologized to retailers that would lose their partnerships, recognizing the impact on smaller businesses. “I know what that means for a small business... I am sorry,” he wrote.

“This decision says nothing about your effort or the way you represented us.” Trezor said the aim is to improve supply chain security by making it easier to monitor devices as they move from the manufacturer to the customer.

Ledger has confirmed that at least one customer's hardware wallet contained an unauthorized hardware implant. The confirmed cases of stolen digital assets have been linked to devices sold by CryptoBilis, a reseller operating in Southeast Asia.

A hardware wallet protects the private keys used to access and spend digital assets like bitcoin. During setup, it displays a recovery phrase, usually made up of 12 or 24 words. Anyone who obtains this phrase can potentially access the wallet's funds, even without the physical device.

According to Ledger's security team, known as Ledger Donjon, there was an unauthorized implant placed inside the device that could read information displayed on its screen. It could then send the recovery phrase to an attacker over a mobile network using an LTE connection and an embedded SIM card.

This means a wallet could appear to work normally while secretly exposing the recovery phrase during setup.

Ledger said the implant does not modify the device's Secure Element, the chip designed to protect sensitive information, or its operating system. It also does not change transactions or digital signatures.

Blockchain investigators have estimated that the incident may have caused losses ranging from tens of millions of dollars to more than $100 million. However, Ledger has not confirmed the total number of victims or the amount stolen.

The investigation expanded after users reported finding suspicious components inside Ledger devices purchased outside Southeast Asia.

In Germany, a customer reportedly discovered an implant in a device bought through European retail. MediaMarktSaturn, the electronics retailer behind MediaMarkt and Saturn, subsequently suspended sales of Ledger wallets in its stores and online.

Ledger confirmed the suspension on October 13 and said no customer funds had been reported lost in the German case.

Mark Karpelès, the former chief executive of the collapsed Mt. Gox exchange, also reported examining a Ledger Flex purchased at Singapore's Changi Airport.

Other users have shared photographs showing extra wires and electronic components inside devices.

However, these reports have not all been independently verified or linked to the confirmed CryptoBilis cases.

Ledger said it has not verified any digital asset theft linked to a device purchased outside the confirmed cases. The company is continuing to examine devices and investigate where the tampering took place.

In another post on October 13, Ledger asked resellers and distributors in Southeast Asia and Hong Kong to suspend sales of its devices while the investigation continues.

The request covers Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong. Resellers were asked to remove Ledger products from their shelves.

Ledger said all confirmed incidents remain limited to Southeast Asia. It also said there is no indication that its internal systems, services or direct sales channel have been compromised.

CryptoBilis has stopped selling hardware wallets while the investigation continues.
Ledger advised customers who bought devices through CryptoBilis not to set up unused wallets.