Trezor Trims Its Reseller Network as Wallet Tampering Fallout Spreads

Trezor is cutting back its authorized reseller network, days after a hardware-wallet tampering scandal pushed it to stop selling through a Southeast Asian distributor.

The company called the reduction a preventive step, taken out of caution, and said it found no evidence that its own devices were compromised. It did not say how many sellers would lose their listing.

The reseller channel became the weak link

The trigger was CryptoBilis, a reseller listed as authorized in Malaysia, Indonesia and the Philippines. Ledger says implants inside Ledger wallets sold through that seller read the 24-word recovery phrase off the screen during setup and shipped it out over LTE using an embedded SIM. The modification never touched the security chip and did not alter transactions — which is exactly why it was so hard to catch.

Loss estimates keep climbing. Investigators put the damage between more than $86 million and as much as $103 million, and Ledger has not confirmed a final total.

Trezor and OneKey both walked away

Trezor says it has received no reports of tampered units from that reseller or any other, yet it removed the seller anyway. OneKey went further: it revoked the reseller's authorization outright, paused onboarding new distributors, and offered free replacements for devices bought there between March 1 and Oct. 12.

CryptoBilis paused sales and shipments of every hardware wallet brand across its stores in those three countries, and temporarily shut its physical locations.

What buyers should actually do

Weighing a device proves nothing, according to Trezor: manufacturing tolerances change the weight, and a modified unit can still land on the expected number. Forcing a case open can wreck the device instead of settling the question.

Guidance for affected buyers is blunter — do not set up an unused device bought from that reseller, and if one is already configured, move the funds to a new device with a fresh recovery phrase.

Here is why this matters if you self-custody. Nothing in this attack broke a chip or a signature scheme; it counted on people trusting a seller because that seller sat on an official partner list. The practical fix is boring and cheap: buy direct from the maker, check the packaging, and never enter a seed phrase into a device that arrived from a third party.