Trezor Ends Reseller Authorizations Following Spy Implant Discovery

Trezor is set to cut its network of authorized resellers, informing partners that their authorization will end on January 1, 2027. This decision follows an investigation by rival hardware wallet manufacturer Ledger, which confirmed the existence of a hidden spy implant in crypto wallets sold through a third-party retailer. Trezor announced this move on X, stating that it has found no evidence of compromised devices but is taking this step as a precautionary measure.

The company explained that the reduction in resellers will allow for more effective vetting of its partners. Trezor noted that recent supply-chain incidents prompted this decision, emphasizing the importance of safeguarding its customers and the integrity of its products. A hardware wallet is designed to keep the secret keys to cryptocurrency offline, protecting them from potential hackers. Users generate a 24-word recovery phrase, which acts as a master password for accessing their wallets.

Ledger's security team reported that wallets sold by CryptoBilis, a reseller in Southeast Asia, contained an unauthorized component capable of reading the screen and decoding the recovery phrase. This spy implant transmits the recovery phrase over LTE, utilizing an embedded SIM card. Ledger clarified that the implant does not interfere with the chip storing the keys or the device's operating system, meaning that a tampered wallet would appear and function normally.

Danny Sanders, Trezor's Chief Commercial Officer, shared a letter sent to the affected resellers, stating that their authorization would end on the specified date. He expressed regret over the decision but emphasized that it does not reflect on the efforts of the resellers. The company will not provide new stock to these partners, although they may continue selling existing inventory through the holiday season.

Reviewing Authorized Seller Partnerships

Trezor has already removed CryptoBilis from its list of authorized sellers and has not received any reports of compromised Trezor devices from that retailer. The company is reviewing its partnerships based on revenue and distribution in each country, implementing stricter rules regarding how devices are sourced, stored, and handled.

Clearance Granted

In a previous incident in May 2022, Trezor warned about counterfeit Model T wallets being sold by unauthorized sellers, which had been tampered with to generate predictable recovery phrases. Trezor advised customers to purchase only from its official store or authorized resellers, a network that is now being reduced. This move comes after a data breach in August, where customer information was exposed due to unauthorized access, although Trezor confirmed that its systems and devices were not affected.

Ledger has advised anyone who purchased from CryptoBilis in the last 90 days not to set up their devices and to transfer their funds to a new seed phrase on a Ledger device. Both Ledger and Trezor have cautioned buyers against unauthorized sellers, highlighting the ongoing risks in the cryptocurrency hardware market.