“So we have made the difficult decision to make our reseller network much smaller, small enough that we can vet and check every partner that remains.”
$93 Million Ledger Incident Casts Shadow Over Hardware Wallet Security
Trezor’s decision follows the Ledger security breach that came to light on Oct. 9, 2026. According to reports, attackers orchestrated a sophisticated physical supply chain compromise, allegedly soldering concealed hardware implants into devices distributed through a third-party reseller, with estimated losses reaching $93 million.
Trezor’s letter confirms that specific reseller partnerships will officially conclude on Jan. 1, 2027, while making clear that the decision does not indicate any compromise of the company’s systems or hardware devices. “Let me be very clear: there is not a single piece of evidence that Trezor devices have been compromised. This is a preventive step, taken out of an abundance of caution,” the company’s letter explains.
A Year of Security Setbacks
Hardware wallet firms have had a terrible year, and there have been close to a dozen incidents involving data breaches, laser fault injection disclosures, a firmware entropy bug, and now the latest supply chain incident. Alongside this, Trezor experienced a data breach in August involving a third-party fulfillment provider, exposing the personal information of tens of thousands of customers.
When it comes to supply chain security, Trezor acknowledges that safeguarding the integrity of its distribution network remains an unrelenting challenge.
“Supply-chain security is never finished, so we are raising the bar for every partner who continues with Trezor, with an updated legal framework and closer checks on how devices are sourced, stored, and handled. We are asking more of everyone in the chain, ourselves included,” the company’s letter states.