Following the highly publicized and large-scale security breach at competitor Ledger, which reportedly caused tens of millions of dollars in cryptocurrency losses, the manufacturer of the Trezor hardware wallet is significantly cutting back on its authorized reseller network.
In a letter to partners, Trezor chief commercial officer Danny Sanders revealed that the company would revoke the authorization for the affected resellers on Jan. 1, 2027, in an effort to take greater control of the supply chain.
This announcement came in the wake of findings of malicious hardware implants within Ledger devices sold through third-party resellers.
While the bold change seems to suggest that the company suspects Trezor devices may be compromised as well, Trezor emphasized that the measure is strictly precautionary, and there is no evidence that Trezor devices have been compromised.
"Let me be very clear: there is not a single piece of evidence that Trezor devices have been compromised," Sanders wrote.
The executive noted that the recent hack against another hardware wallet manufacturer reaffirmed the company's pre-existing concerns regarding the possible risks posed by third-party distribution.
Sanders argued that even if the hardware wallet is technically secure, there is still a risk if hackers can access the wallet before it ends up with the wallet owner.
Reseller agreement
Resellers who received the termination notice will be delisted from the official list of Trezor authorized partners on Jan. 1, 2027.
New inventory will no longer be sent to the affected businesses, but the company said the affected resellers would still be able to sell what remains in their inventory up until the termination date, including through the all-important Black Friday and holiday season.
Trezor explained that the assessment of each individual market was based on revenue, distribution capabilities, and the company's already established presence in the market.
In the end, the company decided that fewer resellers meant more in-depth security checks could be done.
Importantly, the executive underlined that the decision does not reflect poorly on the affected businesses or imply that they have been distributing compromised devices.
For the authorized partners, the company will tighten the contractual agreement and increase its control over how devices are obtained, stored, and handled.
The company did not specify how many resellers would lose their authorization.
Industry woes
The announcement comes just days after hardware wallet manufacturer Ledger was implicated in a significant supply chain security scandal involving a hardware wallet reseller, CryptoBilis, in Southeast Asia.
Ledger acknowledged that certain devices sold through this reseller had unauthorized hardware implants that could intercept users' 24-word recovery phrases when they initialize their devices.
The findings, published by Ledger's Donjon security team, revealed that the malicious implants had the capability to send stolen recovery phrases over cellular networks, potentially exposing users to loss of access to their cryptocurrency funds.
On-chain sleuths have estimated that the event may have led to losses of more than $90 million, though Ledger has not confirmed this figure on its own.
This significant restructuring effort shows that in the wake of the Ledger fiasco, hardware wallet manufacturers are questioning the security implications of third-party distribution, even if there is no evidence that their devices are actually compromised.
Arman Shirinyan
Dan Burgin
