Trezor Cuts Its Resellers After Ledger Finds Spy Implant in Crypto Wallets
Background
Background
CryptoBilis is listed as an official Ledger reseller in Indonesia, Malaysia and the Philippines, and Ledger asked the company to pause all sales and shipments during the investigation. In May 2022, Trezor warned that counterfeit Model T wallets were being sold on a Russian marketplace by a non-authorized seller, with opened, resealed devices whose recovery phrases were predictable or predefined; its advice then was to buy only from its official shop or an authorized reseller. Trezor also said earlier this week that CryptoBilis was already off its seller list and that it had received no reports of tampered Trezor devices from that retailer.
Trezor has told partners in its authorized reseller network that their authorization ends on January 1, 2027, and that it will ship them no new stock, days after rival Ledger's Donjon security team confirmed a hidden spy implant in hardware wallets sold by Southeast Asian reseller CryptoBilis. Trezor said there is "not a single piece of evidence" its own devices were compromised and described the cut as a precaution.
The Ledger finding is a confirmed supply-chain compromise of seed-phrase handling in widely used hardware wallets, and Trezor's decision shows the incident is already reshaping how wallet makers manage third-party distribution.
Ledger says the CryptoBilis implant reads the screen and decodes the recovery phrase when it appears, then sends it out over LTE via an eSIM, without altering the key-storage chip or the operating system, so a tampered wallet looks and works normally. Onchain investigator Specter traced more than $86 million in suspected thefts, a figure Ledger says it has not verified; Trezor has not said how many resellers are affected, and those cut can keep selling existing stock through the holiday season.
rss · Decrypt · · 2 sources
Analysis and references
Impact analysis
The incident transmits mainly through hardware-wallet distribution and self-custody trust: buyers of devices through third-party resellers face elevated counterparty risk, and wallet makers' reseller vetting, device sourcing and after-sale verification become the exposed segment rather than any specific token. Ledger's paused CryptoBilis sales and Trezor's shrinking reseller channel both shift volume toward direct-from-vendor purchases.
References
Tags
#hardware-wallets#supply-chain-attack#security-incident#ledger#trezor#cryptobilis