Trezor: No Reports of Tampered Devices, But Will Restrict Some Resellers

Hardware wallet producer Trezor announced it would reduce its number of resellers as a “preventive step, taken out of an abundance of caution,” following reports that malicious implants had been installed in devices made by competitor Ledger.

In a Tuesday X post, Trezor said there was “not a single piece of evidence that [its] devices have been compromised” after reports that Ledger hardware wallet users had found malicious implants that exposed recovery phrases. 

However, Trezor said that it would reduce the number of its resellers, citing “recent supply-chain incidents.” Chief commercial officer Danny Sanders added that he had notified certain resellers that they would be removed from the company’s list of authorized entities on Jan. 1, and would halt shipments of Trezor devices starting on Tuesday. 

Source: Trezor CCO Danny Sanders

Trezor’s response came just days after Ledger confirmed that at least one of its devices purchased by a Southeast Asian reseller contained an unauthorized hardware implant, potentially leading to millions of dollars in losses for users. The wallets, sold by reseller CryptoBilis, captured recovery phrases and transmitted them over cellular networks.

“Our setup checks are built to catch counterfeit devices and modified firmware,” a Trezor spokesperson told Cointelegraph. “The implant found in a device bought from CryptoBilis works differently. This is a unique way of tampering with the device, which doesn’t modify the firmware, but reads information on the screen and later sends it to the attacker. So far, we have not seen this specific type of attack on Trezor devices in the real world.” 

Related: Ledger investigates fund losses linked to Southeast Asian reseller, warns users

During the investigation, CryptoBilis, an authorized Trezor reseller, suspended all hardware wallet sales. The parent company of European electronics retailer MediaMarkt also announced that it had removed all Ledger products from its physical stores and online platforms “as a precautionary measure.”

How much in user funds was lost?

Blockchain sleuths are still investigating the extent of losses for hardware wallet users, but research from two individuals suggested between $72 million and $86 million. Ledger reported on Tuesday that it had “not confirmed the total number of affected users or the total value lost” due to the breaches.

The Trezor spokesperson advised users to buy products directly from the company, “checking the seal is intact,” and consider a multisignature wallet “with devices from different makers, so one compromised device can’t move funds on its own.”

Magazine: Do the Coldcard attacks mean all hardware wallets are now insecure?