Trezor Adjusts Reseller Network Following Reports of Ledger Tampering Incidents

What happened

Hardware wallet provider Trezor has announced adjustments to its reseller network. Trezor's Chief Commercial Officer, Danny Sanders, stated that certain hardware wallet resellers have been informed that their authorization will be revoked. Some of these changes are set to take effect starting January 1, 2027. This move by Trezor comes amid recent reports concerning physical tampering with hardware wallets from another prominent manufacturer, Ledger.

Ledger confirmed that some of its wallets, specifically those sold by a retailer in Southeast Asia, contained a hidden physical implant. This implant was designed to compromise user security by reading the 24-word recovery phrase during the initial device setup process. According to Ledger, this implant operated by extracting the recovery phrase directly from the device's screen during setup, without directly affecting the secure element or its software. The presence of such implants has been linked to incidents involving the unauthorized drainage of funds from affected wallets, with one report suggesting potential losses amounting to approximately $86 million.

Why it matters

Trezor's decision to re-evaluate and reduce its reseller network is presented as a preventative measure in light of these tampering reports. The incidents involving Ledger wallets highlight a significant supply chain vulnerability within the hardware wallet industry. While hardware wallets are designed to be highly secure against digital attacks, physical tampering at the point of sale or during distribution can undermine their core security promises. The confirmation of physical implants capable of extracting recovery phrases before a user can even interact with the device's secure software underscores a critical risk for consumers.

This development suggests a heightened awareness among hardware wallet manufacturers regarding the security of their distribution channels. By scrutinizing and potentially limiting their reseller partnerships, Trezor appears to be taking steps to mitigate similar risks for its customers. For the broader cryptocurrency market, these events emphasize the ongoing importance of securing every link in the chain, from manufacturing to the end-user, especially for devices designed to protect sensitive private keys.

Safety notes

Users of hardware wallets should remain vigilant regarding the source of their devices. Purchasing directly from the manufacturer or through explicitly authorized and well-vetted resellers is generally recommended. Upon receiving a new hardware wallet, users should always inspect the packaging for any signs of tampering, such as broken seals, altered components, or any indication that the device may have been opened or modified. The integrity of the physical device and its packaging is a critical first line of defense. Any suspicious findings should lead to immediate contact with the manufacturer and avoidance of device setup or use. These incidents underscore that even robust cryptographic security can be circumvented if the physical device itself is compromised before it reaches the user.

Sources

• Trezor reduces resellers as a ‘preventative step’ amid Ledger tampering reports — Cointelegraph
• Trezor Cuts Its Resellers After Ledger Finds Spy Implant in Crypto Wallets — Decrypt
• Trezor Reduces Number of Resellers Following Ledger Drainage Incident — Bitcoin Magazine
• Ledger Finds LTE Implant That Stole Recovery Phrases in Suspected $86M Drain — Decrypt