Trezor to drop some resellers in 2027 after hardware wallet supply-chain attacks

Trezor is shrinking its reseller network and will end authorizations for some partners beginning in 2027, the hardware wallet maker said in an Oct. 13 statement. Chief Commercial Officer Danny Sanders outlined the change in a letter, saying affected partners will receive no new stock after the announcement but may continue selling remaining inventory through Black Friday and the holiday season. The move follows two security incidents involving third-party service providers and distributors that have raised concerns about hardware wallet supply chains.

Sanders said Trezor assessed each market individually, weighing revenue, distribution coverage and the company's own presence to ensure customers could still buy genuine devices. Partners that remain will face tighter requirements under an updated legal framework, along with closer checks on how devices are sourced, stored and handled. Trezor added that it may review the policy if circumstances change.

Sanders acknowledged the decision's impact on small businesses, noting that Trezor may account for a meaningful share of a partner's revenue or be a product line a shop was built around. He said the move says nothing about partners' effort or how they represented the company, and apologized for the disruption, according to the letter.

The distribution changes come after Trezor disclosed that a ShipMonk data breach affected nearly 81,000 customers. Exposed records included names, email addresses, phone numbers, shipping addresses and order numbers. Trezor said its own systems and devices were unaffected, but warned the information could be used in phishing and targeted impersonation attacks.

Concerns intensified after rival Ledger confirmed an unauthorized hardware implant in a device sold through CryptoBilis, a Southeast Asian reseller. According to Ledger, the implant can capture the 24-word recovery phrase shown on the device's screen during setup and send it over LTE using an embedded eSIM, without modifying the device's Secure Element or operating system. Ledger said all confirmed cases of unexpected fund losses linked to the Oct. 9 incident involved CryptoBilis-sold devices, while reports of implants in other devices and locations remain under review.

On-chain analyst Specter estimated that reported losses could exceed $86 million, though Ledger has not confirmed the total. For Trezor, the reseller changes take effect for affected partners in 2027, with sell-through of existing stock permitted through the holiday season.