Trezor Shrinks Reseller Network After Hardware Wallet Supply-Chain Incidents

Trezor is reducing its reseller network so it can check partners more closely, widening its response to hardware-wallet supply-chain incidents after already halting sales through CryptoBilis.

The hardware-wallet maker announced the reduction on Oct. 13, calling it “a preventive step, taken out of an abundance of caution.” It said there was no evidence that Trezor devices had been compromised. The announcement did not quantify how many resellers would be removed.

Trezor had already removed CryptoBilis from its reseller list and stopped sales through the company as a precaution. It said it had no reports of tampered Trezors from that seller or any other reseller.

The wider pullback comes as rival Ledger continues investigating unauthorized hardware implants in wallets sold through CryptoBilis, a Southeast Asian reseller. In an Oct. 13 update, Ledger said the implants read information displayed on a wallet’s screen during setup and transmit its 24-word recovery phrase over LTE using an eSIM.

The attack described earlier by The Defiant targets the displayed recovery phrase without modifying the device’s secure chip or operating system, according to Ledger.

Ledger said all confirmed fund losses tied to the incident disclosed on Oct. 9 involved CryptoBilis-sold devices. It is also reviewing reports of implants in other devices and locations, and has not confirmed a total number of affected users or value lost.

Guidance for Reseller Buyers

Trezor directs concerned owners to customer support through its official site. It recommends buying only through its own online store or sellers in its official directory, which also links to its Amazon storefronts.

The company says weighing a device cannot reliably establish that it is genuine: manufacturing tolerances can change the weight, while a modified device could still weigh the expected amount. It has also warned users against forcing a wallet’s casing open, saying this can damage the device.

Ledger’s instructions for its own CryptoBilis customers are more urgent: do not set up an unused device from the reseller; if it is already set up, promptly transfer assets to a new device with a new recovery phrase. Ledger also warns against entering or restoring any recovery phrase on a CryptoBilis-bought device.