By Nathan Brooks

Hardware wallet manufacturer Trezor has reduced the number of resellers it works with following supply-chain incidents tied to its competitor Ledger, the Prague-based company said in a post on X on Tuesday, October 13, 2026. Trezor added that it is in the process of checking which vendors it works with, and stated that no issues with Trezor devices have been reported.

The move responds to an incident at Ledger, which said last week it had opened an investigation after customers in South East Asia reported losing funds after buying devices from Malaysia-based reseller CryptoBilis.

What happened at Ledger?

Ledger subsequently confirmed that one impacted user's device contained an unauthorized hardware implant. According to the company, the implant was able to read a seedphrase when it appeared on the device's screen — a direct compromise of the recovery mechanism that hardware wallets exist to protect.

More reports of what appear to be tampered devices have since surfaced on social media. But Ledger said Tuesday that only devices sold through CryptoBilis have been linked to lost funds, and that it has confirmed an unauthorized hardware implant in just one affected user's device.

Ledger did not disclose the total value lost. Blockchain investigator Specter estimated that $86 million had been drained from devices.

"We have not confirmed the total number of affected users or the total value lost," Ledger wrote on X. "Figures circulating online come from third parties and Ledger has not fully verified them."

CryptoBilis has stopped selling devices, Ledger said. The company advised customers who purchased through CryptoBilis not to set up their devices and to contact Ledger support. Ledger did not respond to Bitcoin Magazine's questions.

Why Trezor acted preemptively

Trezor framed its reseller reduction as a distribution-security measure rather than a response to any compromise of its own products.

"Let us be very clear: there is not a single piece of evidence that Trezor devices have been compromised," the company wrote.

"This is a preventive step, taken out of an abundance of caution."

For practitioners, the calculus is straightforward: a smaller reseller network concentrates audit and verification effort on fewer counterparties, raising the cost of any single vendor becoming an attack vector.

A pattern of hardware wallet targeting

The incident fits a broader pattern of criminals targeting hardware wallets this year:

• In July, hackers stole close to $120 million in bitcoin from Coldcard users by exploiting a firmware bug. Manufacturer Coinkite, a Canadian company, said the bug caused faulty seed generation, allowing attackers to guess seedphrases.
• Last month, Trezor reported that close to 81,000 customers had their details leaked after data was stolen from its third-party fulfillment partner.
• Earlier this year, scammers obtained customer information through Ledger's payment processor Global-e and used it to send phishing emails.

What does this change for buyers?

What does this change for custody practice? Purchasing channel now carries the same weight as device firmware. An authentic device bought through an unverified intermediary can be modified in transit — the CryptoBilis case demonstrates that a hardware implant can capture a seedphrase at entry, rendering even a genuine signing device insecure.

The practical sequence is: verify the reseller against the manufacturer's official list before purchase, and treat any device sourced outside that list as untrusted until inspected.

For the manufacturers, the commercial consequence is a forced contraction of retail distribution. Trezor has set the precedent; whether Ledger follows with its own reseller purge, and whether either company publishes audited vendor lists, will shape how hardware wallets reach retail customers through the rest of the year.