Crypto: Faced with modified Ledgers, Trezor tightens its network of resellers

Trezor will reduce its network of authorized resellers from January 1, 2027. Dating from October 13, 2026, this announcement comes after security incidents affecting Ledger wallets sold by CryptoBilis. The measure aims to strengthen the control of devices before their delivery. Especially since no compromised Trezor device has been identified at this stage.

Crypto: why is Trezor reducing its reseller network?

In a letter to partners made public on October 13, 2026, Trezor Chief Commercial Officer Danny Sanders announces the withdrawal of approval of some of its crypto resellers. The goal: to strengthen control of the supply chain.

The latter will no longer receive new deliveries. They will nevertheless be able to sell the devices already available until January 1, 2027. Trezor therefore gives them the period of Black Friday and the holidays before their removal from the official list.

For now, the exact number of authorized resellers affected by this announcement remains unknown. The same applies to the markets concerned. Trezor will judge each country separately according to:

• turnover;
• distribution;
• its local presence.

During a statement dated October 13, 2026, the manufacturer counted 87 entries in his directory (distributed in 44 countries). This corresponds to 80 distinct names, with some sellers appearing in several countries. This figure describes the directory observed on this date. It does not correspond to the number of resellers who will be removed.

However, Trezor already underlines an important point: retained partners will sign a stricter framework on the supply, storage and handling of devices. Danny Sanders insists on the preventive nature of the measure. He also apologizes to the affected businesses.

There is not a single piece of evidence that Trezor devices were compromised.

Danny Sanders, Trezor Sales Director, letter to resellers dated October 13, 2026, translated from English.

Crypto: how did the modified Ledger implant work?

The incident concerns Ledger crypto wallets sold by CryptoBilisa Southeast Asian reseller. The first confirmation regarding a crypto user’s device dates back to October 10.

According to Ledger, these devices contained an unauthorized hardware component capable of reading the recovery phrase displayed during setup and then sending it over a mobile network. More explicitly, when the implant detects these screens, its microcontroller decodes the words, then transmits them by LTE using an eSIM. What can give attacker access to crypto assetswithout him keeping the device.

Ledger nevertheless makes an important point:

The implant is a separate component. It does not modify the Secure Element or the Ledger operating system, and does not alter transactions or signatures.

Ledger, statement dated October 13, 2026, translated from English.

In other words, hardware implant bypasses protection by capturing information displayed to the user. Still, the attack takes place before the device is handed over. Hence the supply chain issue

Losses remain unconfirmed estimates

Some researchers and media report estimates of up to $93.2 million in losses, spread across more than 300 crypto wallets. These figures were notably cited by CoinDeskbut Ledger did not validate them.

Other estimates are circulating, between more than 86 million and 103 million dollars. They come from third parties and differ according to:

• the accounting method;
• the crypto wallets selected;
• the date of observation.

They should therefore not be presented as a definitive assessment.

For his part, Ledger has neither confirmed the total number of crypto users affected nor the total value lost. The company says, however, that all confirmed losses related to the incident disclosed on October 9 relate to devices sold by CryptoBilis. Until today, it continues to examine reports from other places.

We have not confirmed the total number of users affected or the total value lost. The figures circulating online come from third parties and have not been fully verified by Ledger.

Ledger, statement dated October 13, 2026, translated from English.

How to buy a Trezor crypto wallet securely?

A currently authorized partner may no longer be listed in theTrezor directory after January 1, 2027. For a new crypto purchasethe verification must therefore relate to the status of the distributor at the time of the order.

Trezor also prompts to verify seals and perform authenticity checks in Trezor Suite. If there is an abnormality in the setup instructions or firmwareit is imperative to contact their assistance. The manufacturer reminds you to never enter backup words into a site, application or form.

At Ledger, the instructions are more targeted. A device purchased from CryptoBilis and never configured must not be initialized. If it has already been used, Ledger asks to transfer crypto assets to a new device with a new recovery phrase.

With Trezor, crypto security in any case comes down to an industrial question: who controls the device before its delivery? Tightening the network could improve traceability. However, its effect on access to products remains to be measured, market by market. To be continued…