Trezor cuts resellers as 'preventive step' after Ledger device tampering reports
In brief
- Trezor is reducing its resellers, calling the move a preventive step after Ledger tampering reports.
- Some resellers will lose authorized status on Jan. 1, according to CCO Danny Sanders.
- Ledger confirmed a device sold via reseller CryptoBilis carried an unauthorized hardware implant.
- Trezor said there is no evidence its own devices have been compromised.
- Ledger has not confirmed the total number of affected users or the value lost.
Who's losing authorized status
Chief commercial officer Danny Sanders said he'd notified certain resellers that they'll be removed from Trezor's list of authorized entities on Jan. 1. Shipments of Trezor devices to them halted starting Tuesday.
Trezor called the move a "preventive step, taken out of an abundance of caution," and said in its Tuesday X post there was "not a single piece of evidence that [its] devices have been compromised." The company pointed to "recent supply-chain incidents" as the reason for the cuts.
What happened with Ledger
Days before Trezor's response, Ledger confirmed that at least one of its devices bought from a Southeast Asian reseller contained an unauthorized hardware implant, which could have led to millions of dollars in user losses, according to Cointelegraph's report. The wallets, sold by reseller CryptoBilis, captured recovery phrases and transmitted them over cellular networks.
CryptoBilis was also an authorized Trezor reseller.
It suspended all hardware wallet sales during the investigation. Ledger said Tuesday it hadn't confirmed the total number of affected users or the total value lost. Research from two individuals cited by Cointelegraph puts losses to hardware wallet users at between $72 million and $86 million. That's an unverified estimate, and blockchain investigators are still working out the extent.
Retail is reacting too. The parent company of European electronics retailer MediaMarkt said it removed all Ledger products from its physical stores and online platforms as a precaution.
Trezor's read on the implant
A Trezor spokesperson told Cointelegraph the company's setup checks are built to catch counterfeit devices and modified firmware. This implant doesn't touch the firmware at all, though, and that's what makes it different.
"This is a unique way of tampering with the device, which doesn’t modify the firmware, but reads information on the screen and later sends it to the attacker. So far, we have not seen this specific type of attack on Trezor devices in the real world." (Trezor spokesperson, speaking to Cointelegraph)
The spokesperson's advice to users is simple: buy directly from the company, check that the seal's intact, and consider a multisignature wallet built with devices from different makers.
Frequently asked questions
Why is Trezor cutting some of its resellers?
Trezor called it a preventive step and cited recent supply-chain incidents, after Ledger confirmed a tampered device sold through a Southeast Asian reseller. CCO Danny Sanders said certain resellers will be removed from the authorized list on Jan. 1, and shipments to them halted starting Tuesday.
How did the CryptoBilis hardware implant work?
The affected Ledger wallets, sold by reseller CryptoBilis, captured recovery phrases and transmitted them over cellular networks. A Trezor spokesperson said the implant didn't modify firmware but read information on the screen and later sent it to the attacker.
Are Trezor devices affected by the tampering?
Trezor said in a Tuesday post on X that there was no evidence its devices had been compromised. A spokesperson said the company hadn't seen this specific type of attack on Trezor devices in the real world, though CryptoBilis was also an authorized Trezor reseller.
