Hardware wallet manufacturer Trezor has reduced its reseller network following supply-chain incidents that affected competitor Ledger, the company announced Tuesday. Trezor said the move allows it to more effectively vet vendors it partners with.
"Let us be very clear: there is not a single piece of evidence that Trezor devices have been compromised," the Prague-based company stated. "This is a preventive step, taken out of an abundance of caution."
Ledger's Compromised Devices
Ledger disclosed last week that customers in Southeast Asia reported losing funds after purchasing devices from Malaysia-based reseller CryptoBilis. The company later confirmed that at least one affected user's device contained an unauthorized hardware implant capable of reading the device's seedphrase when displayed.
Ledger stated that only devices sold through CryptoBilis have been linked to confirmed fund losses, and it has verified a hardware implant in only one user's device. The company advised customers who purchased from CryptoBilis to avoid setting up their devices and to contact Ledger support.
Blockchain investigator Specter reported that $86 million had been drained from compromised devices, though Ledger cautioned that it had not independently verified figures circulating online. "We have not confirmed the total number of affected users or the total value lost," Ledger stated on X. CryptoBilis has stopped selling devices.
Broader Hardware Wallet Security Concerns
The incident reflects ongoing security challenges in the hardware wallet sector. In July, hackers exploited a firmware bug in Coldcard devices that caused faulty seed generation, allowing them to steal close to $120 million in bitcoin from users who could not guess investor seedphrases.
In a separate incident, Trezor reported that approximately 81,000 customers had their personal details leaked after its third-party fulfillment partner experienced a data breach. Earlier this year, scammers obtained customer information from Ledger through its payment processor Global-e to send phishing emails.
