Trezor cuts down authorized reseller network as 'precautionary measure' following Ledger device tampering incidents
Chief Commercial Officer Danny Sanders revealed that several hardware wallet resellers received notifications about their removal from Trezor's authorized entity list effective January 1.
Cryptocurrency hardware wallet manufacturer Trezor has made the decision to trim down its roster of resellers, describing the move as a "preventive step, taken out of an abundance of caution," in the wake of emerging reports detailing malicious implants discovered in hardware wallets manufactured by rival company Ledger.
Through a post shared on X this Tuesday, Trezor stated there exists "not a single piece of evidence that [its] devices have been compromised" following news that users of Ledger hardware wallets had discovered malicious implants designed to expose their recovery phrases.
Nevertheless, Trezor confirmed its decision to decrease its reseller count, pointing to "recent supply-chain incidents" as the reason. Danny Sanders, who serves as the chief commercial officer, further explained that he had sent notices to specific resellers informing them of their upcoming removal from the company's authorized entity roster effective Jan. 1, and that shipments of Trezor devices to these entities would cease beginning Tuesday.
The response from Trezor followed mere days after Ledger provided confirmation that no fewer than one of its hardware devices acquired through a reseller based in Southeast Asia had been found to contain an unauthorized hardware implant, which could potentially result in losses running into millions of dollars for affected users. These compromised wallets, distributed by the reseller known as CryptoBilis, were designed to capture users' recovery phrases and subsequently transmit the sensitive information via cellular networks.
"Our setup checks are built to catch counterfeit devices and modified firmware," a Trezor spokesperson told Cointelegraph. "The implant found in a device bought from CryptoBilis works differently. This is a unique way of tampering with the device, which doesn't modify the firmware, but reads information on the screen and later sends it to the attacker. So far, we have not seen this specific type of attack on Trezor devices in the real world."
Throughout the course of the investigation, CryptoBilis, which held status as an authorized Trezor reseller, made the decision to suspend all of its hardware wallet sales operations. Additionally, the parent company overseeing European electronics retail chain MediaMarkt issued an announcement stating it had pulled all Ledger products from both its brick-and-mortar store locations and digital sales platforms "as a precautionary measure."
How much in user funds was lost?
Investigators analyzing blockchain data continue to examine the full scope of losses experienced by hardware wallet users, though research conducted by two separate individuals has suggested figures ranging between $72 million and $86 million. In a statement issued on Tuesday, Ledger acknowledged that it had "not confirmed the total number of affected users or the total value lost" as a result of the security breaches.
The spokesperson representing Trezor recommended that users purchase products directly from the company itself, "checking the seal is intact," and also suggested they consider implementing a multisignature wallet "with devices from different makers, so one compromised device can't move funds on its own."