Secure

Element

Hardware wallet manufacturer Trezor is reducing its authorized reseller network following the discovery of malicious implants in Ledger devices sold through third-party distributors, as blockchain investigators raise estimated losses from the CryptoBilis incident to $102 million.
Trezor <a href="https://www.reddit.com/r/TREZOR/comments/1x4xcwg/trezor_supply_chain_statement/" rel="noopener noreferrer nofollow">announced the precautionary changes</a> on October 13, confirming that affected distribution partners will lose their authorization on January 1, 2027. New shipments to those resellers have already stopped.
The company also removed Southeast Asian retailer CryptoBilis from its authorized network after Ledger identified tampered devices distributed through the same business.
Trezor stressed that it has received no evidence of compromised devices bearing its own brand.
<h2 id="trezor-ends-reseller-agreements-starting-january-2027">Trezor Ends Reseller Agreements Starting January 2027</h2>
Chief Commercial Officer Danny Sanders outlined the changes in a letter to distribution partners, explaining that Trezor could no longer maintain the same level of oversight across its existing reseller network.
Affected partners can sell their remaining inventory through the holiday season but will receive no additional stock from Trezor. Their authorization expires at the beginning of 2027.
The company plans to introduce stricter partner verification and updated contractual requirements covering product sourcing, storage and handling.
Sanders emphasized that the decision did not indicate misconduct by the affected resellers. He also publicly thanked longstanding partners and apologized for terminating their commercial relationships.
<a href="https://cryptoadventure.com/community/articles/complete-overview-of-trezor-hardware-wallets-and-accessories/" rel="noopener noreferrer nofollow">Trezor</a> has not disclosed how many retailers will lose authorization or which markets will be affected.
<h2 id="ledger-confirms-recovery-phrase-theft-through-hidden-lte-implants">Ledger Confirms Recovery Phrase Theft Through Hidden LTE Implants</h2>
The changes follow Ledger’s investigation into <a href="https://cryptoadventure.com/ledger-probes-cryptobilis-wallet-drains-as-estimated-losses-reach-92-9-million/" rel="noopener noreferrer nofollow">CryptoBilis-linked wallet drains</a> affecting customers across Southeast Asia.
Ledger’s Donjon security team identified an unauthorized electronic implant concealed inside affected <a href="https://cryptoadventure.com/best-hardware-wallets-to-use-in-2026-secure-cold-storage-without-the-confusion/" rel="noopener noreferrer nofollow">hardware wallets</a>. The component intercepted the 24-word recovery phrase displayed during device initialization and transmitted the information over LTE using an embedded SIM.
The implant operated independently of Ledger’s Secure Element and did not modify its operating system or transaction signatures.
Ledger has <a href="https://www.reddit.com/r/ledgerwallet/comments/1x36ahk/which_ledger_signer_model_was_exploited_in_this/" rel="noopener noreferrer nofollow">confirmed that its investigated cases involved devices sold through CryptoBilis</a>, while maintaining that its internal systems and direct sales channels remain unaffected.
The incident adds a new physical supply-chain dimension to concerns previously raised over <a href="https://cryptoadventure.com/ledgers-free-from-compromise-claim-faces-backlash-over-past-breaches/" rel="noopener noreferrer nofollow">Ledger’s security record</a>, which included earlier customer-data breaches and a software supply-chain exploit.
Blockchain intelligence firm Bitquery has since <a href="https://www.bitquery.io/investigations/ledger-cryptobilis-hack" rel="noopener noreferrer nofollow">traced an estimated $102 million</a> in stolen assets across 324 wallets on six blockchains, exceeding initial estimates of $86 million.
The investigation identified coordinated withdrawals across Tron, Bitcoin, Ethereum, Solana, BNB Chain and Polygon. Tether also froze approximately $10 million in USDT connected to the suspicious transfers.
Ledger has not independently confirmed the total loss figure.
<h2 id="mediamarkt-suspends-ledger-sales-as-investigation-expands">MediaMarkt Suspends Ledger Sales as Investigation Expands</h2>
The investigation has also reached European retailers.
MediaMarktSaturn <a href="https://x.com/Ledger/status/2109984923343782374?s=20" rel="noopener noreferrer nofollow">suspended sales of affected Ledger products</a> following a customer’s report of modified hardware purchased in Germany.
The customer reported finding additional wiring and cellular communication components inside two devices acquired from different MediaMarkt locations.
Ledger acknowledged the German report but said no associated fund losses had been identified. The company has not established a connection between those devices and the CryptoBilis thefts.
Another wallet manufacturer, <a href="https://cryptoadventure.com/onekey-review-2026-open-source-security-hardware-wallets-and-app-features/" rel="noopener noreferrer nofollow">OneKey</a>, has revoked CryptoBilis’ reseller authorization and offered free replacement devices to customers who purchased its products through the retailer between March 1 and October 13.
<a href="https://cryptoadventure.com/community/articles/complete-overview-of-ledger-hardware-wallets-and-accessories/" rel="noopener noreferrer nofollow">Ledger</a> continues to advise CryptoBilis customers against initializing unused devices. Those who already configured affected wallets should transfer their assets to a securely generated wallet with a new recovery phrase.
Trezor’s broader reseller changes will take effect on January 1, 2027, with its revised distribution controls intended to reduce the number of intermediaries handling customer devices.
The post <a href="https://cryptoadventure.com/trezor-cuts-resellers-after-ledger-wallet-implants-linked-to-102m-in-suspected-theft/" rel="noopener noreferrer nofollow">Trezor Cuts Resellers After Ledger Wallet Implants Linked to $102M in Suspected Theft</a> appeared first on <a href="https://cryptoadventure.com" rel="noopener noreferrer nofollow">Crypto Adventure</a>.

Trezor Cuts Resellers After Ledger Wallet Implants Linked to $102M in Suspected Theft

Table of Contents

Crypto Adventure

Other articles published on Oct 14, 2026

Join our free newsletter for daily crypto updates!