News about Trezor

Ledger has asked resellers and distributors in six Southeast Asian countries and Hong Kong to suspend sales and pull its hardware wallets from shelves while it investigates devices fitted with a hidden implant. The implant reads the 24-word recovery phrase during setup and sends it out over LTE, so anyone holding that phrase can move the wallet's funds. All confirmed losses involve devices sold through CryptoBilis, a regional reseller, and Ledger has not verified any drain linked to devices bought elsewhere, nor sees any indication its own systems were compromised. Onchain investigator Specter has traced more than $86 million in suspected thefts, a figure Ledger has not verified. MediaMarkt Saturn stopped selling Ledger devices after a German customer reported an implant, though no funds were lost, and rival Trezor will end reseller authorizations on January 1, 2027 as a precaution.

Hardware wallet maker Trezor said it will reduce its number of resellers as a “preventive step” following reports that malicious implants were found in competitor Ledger’s devices. Chief commercial officer Danny Sanders said certain resellers will be removed from the authorized list on January 1 and will stop receiving Trezor shipments from Tuesday. Trezor said there is “not a single piece of evidence” that its own devices have been compromised, while Ledger confirmed that at least one device sold by reseller CryptoBilis in Southeast Asia contained an unauthorized implant that captured recovery phrases. Researchers estimate losses of between $72 million and $86 million, though Ledger has not confirmed the total number of affected users or value lost. CryptoBilis suspended all hardware wallet sales, and the parent company of MediaMarkt removed all Ledger products from its stores and online platforms.

Trezor will end its reseller authorizations on January 1, 2027 and stop shipping new stock to them, calling it a precaution after supply-chain incidents and saying there is no evidence its devices were compromised. The move follows Ledger's Donjon team finding that wallets sold by Southeast Asian reseller CryptoBilis carried a spy implant that captures recovery phrases from the screen and sends them over LTE. Ledger told anyone who bought from CryptoBilis in the past 90 days not to set up their device, while onchain investigator Specter traced more than $86 million in suspected thefts, a figure Ledger says it has not verified. Trezor says CryptoBilis was already off its seller list and that it has received no reports of tampered devices from that retailer. Separately, a ShipMonk data exposure in August affected Trezor customers, with the total put at 80,689 in September, though Trezor says its devices, private keys and wallet backups were not affected.