Trezor has reduced the number of resellers it works with, following supply-chain incidents tied to its competitor Ledger. The hardware wallet maker said there is no evidence its own devices have been compromised, and described the move as a preventive step taken out of an abundance of caution.
The announcement lands in the same week that Ledger confirmed an unauthorized hardware implant in the device of one affected user — an implant that could read a seed phrase when it appeared on the screen. Ledger launched its investigation after customers in South East Asia reported lost funds after buying from CryptoBilis, a Malaysia-based reseller.
What Ledger actually confirmed
Ledger's statement is narrow. Only devices sold through CryptoBilis have been linked to lost funds so far. The company says it has not confirmed the total number of affected users or the total value lost. CryptoBilis has stopped selling devices.
Blockchain investigator Specter claimed $86 million was drained from devices. Ledger pushed back on that figure, saying numbers circulating online come from third parties and have not been fully verified. That gap — between a public claim and an unconfirmed company response — is where the story sits right now.
Ledger's advice to customers who bought from CryptoBilis is blunt: don't set up your device, and contact Ledger support.
The implant, explained without the spin
A hardware implant that can read a seed phrase as it appears on the device is about as direct a threat as a wallet user can face. The seed phrase is the master key. If it's captured at the moment of setup or recovery, the attacker doesn't need to break encryption — they just wait.
That's the part that makes this different from a phishing email or a leaked database. A phished customer can change passwords. A leaked address list can be monitored. A compromised seed phrase means the funds are gone the moment they move.
Trezor's caution and its own rough year
Trezor didn't name Ledger or CryptoBilis in its announcement, and it didn't detail which resellers are being cut. The framing was defensive: no evidence of compromise on its side, but a reduced reseller footprint anyway.
The timing isn't great for the hardware wallet sector generally. Last month, Trezor reported that close to 81,000 customers had their details leaked after its third-party fulfillment partner had data stolen. Earlier this year, scammers obtained customer information via Ledger's payment processor Global-e to send phishing emails.
And in July, hackers stole close to $120 million in bitcoin from Coldcard users. The cause was a firmware bug that produced faulty seed generation, which let attackers guess seed phrases. Three different hardware wallet makers, three different failure points: logistics, payments, firmware.
The supply chain keeps being the weak link
What connects the CryptoBilis case to the others is that the compromise didn't happen inside the device manufacturer's own walls. It happened in the chain of custody — the reseller, the fulfillment partner, the payment processor. Users buy a sealed box and assume the box is the trust boundary. It isn't.
Ledger hasn't said how many CryptoBilis devices are out there or how it plans to identify them. It also hasn't said whether it will replace affected units or reimburse losses. Those are the next concrete questions, and until Ledger answers them, customers who bought through that reseller are stuck holding a device they've been told not to turn on.
