Trezor cuts sellers as a "precautionary step" amid reports of ledger tampering

CCO Danny Sanders said he has notified some hardware wallet vendors that they will be removed from Trezor's list of authorized entities as of January 1st.

After reports of malicious implants being installed in devices made by Ledger, hardware wallet maker Trezor announced it was reducing its vendor count as a "precautionary step, out of an abundance of caution."

In a Tuesday X post, Trezor said there was "no evidence that [its] devices were compromised" following reports that users of the Ledger hardware wallet had found malicious implants that leaked recovery phrases.

However, Trezor said it would reduce its number of dealers, citing "recent supply chain incidents." Chief Commercial Officer Danny Sanders added that he has notified some vendors that they will be removed from the company's list of authorized entities on January 1 and will stop shipping Trezor devices as of Tuesday.

Trezor's response comes just days after Ledger confirmed that at least one device purchased by a Southeast Asian vendor contained an unauthorized hardware implant, potentially costing users millions of dollars in losses. Wallets sold by the CryptoBilis vendor capture recovery phrases and send them over cellular networks.

A Trezor spokesperson told Cointelegraph, “Our launch checks are built to catch counterfeit devices and modified firmware. “The implant found in the device purchased from CryptoBilis works differently. This is a unique method of manipulating the device that does not change the operating system, but reads the information on the screen and later sends it to the attacker. "So far, we have not seen this particular type of attack on Trezor devices in the real world."

During the investigation, CryptoBilis, an authorized Trezor reseller, suspended all sales of the hardware wallet. The parent company of European electronics retailer MediaMarkt also announced that it had removed all Ledger products from its physical stores and online platforms "as a precautionary measure".

Blockchain detectives are still investigating how much hardware wallet users have lost, but two people's research puts it between $72 million and $86 million. Ledger reported on Tuesday that it had not confirmed "the total number of users affected or the total value lost" due to the breaches.

A Trezor spokesperson advised users to buy products directly from the company, to "check the seal is sound" and to consider a multi-signature wallet "with devices from different manufacturers" so a compromised device cannot move funds on its own.