Trezor has cut back its network of authorized resellers following supply-chain incidents involving its hardware wallets. The Czech hardware wallet maker confirmed that CryptoBilis is no longer on its list of authorized sellers. Trezor is framing the reduction as a preventive measure and says it has found no evidence that its devices were compromised.
What Trezor actually said
The company's position is narrow, and that matters. Trezor isn't saying wallets were tampered with in transit, and it isn't naming a specific breach. It is saying it has no evidence its devices were compromised — a careful distinction that leaves room for the possibility that something went wrong in the distribution chain without touching the hardware itself.
Reseller networks are the soft underbelly of hardware wallet security. A device can leave the factory sealed and still arrive in a user's hands after passing through a seller who repackaged it, swapped it, or seeded a pre-generated recovery phrase. That's the attack surface Trezor is reacting to, even if the company won't describe the incidents in detail.
Why CryptoBilis got dropped
CryptoBilis is the named casualty here. Trezor hasn't explained the specific reason for removing the reseller, and the company's public line stops at the preventive-measure framing. What's clear is that the authorized-seller list is now shorter, and CryptoBilis is no longer on it.
For anyone who bought a Trezor through CryptoBilis, the practical question is whether the device is safe to use. Trezor says its devices weren't compromised, which suggests the risk sits with the supply chain rather than the hardware. But users who want certainty should verify their device's firmware and check that the recovery phrase wasn't pre-filled — standard hygiene that applies regardless of where a wallet was purchased.
The supply-chain problem nobody solves
Hardware wallets are only as trustworthy as the last person who touched the box. Trezor's move is the kind of thing every manufacturer in this space quietly does when a distributor starts looking like a liability. The difference is that Trezor is doing it in public, which puts pressure on the remaining authorized sellers to demonstrate they're clean.
It also raises a question Trezor hasn't answered: how many resellers were cut, and what triggered the review. A single removal could be routine. A broader cull points to something more systematic in how devices were moving through third parties.
What buyers should do now
If you're in the market for a Trezor, the safe path is buying directly from the manufacturer or from a seller still on the authorized list. If you already own one bought through a reseller that's since been dropped, don't panic — but do check the device. Firmware verification and a fresh recovery phrase cost nothing and settle the question.
Trezor hasn't said whether more resellers will be removed or whether the review is finished. That's the open thread. Until the company says otherwise, the authorized-seller list is the only reliable signal of who's still trusted to move its hardware.
