TL;DR:
- Estimates from on-chain analytics firms like Bitquery place losses linked to the compromised Ledger wallets at over $93 million.
- On October 11, 2026, Trezor delisted distributor CryptoBilis from its commercial directory and confirmed the halt of new inventory shipments to terminated partners.
- The company set January 1, 2027, as the deadline for its new regulatory framework to take effect and for publishing its pruned list of authorized sellers.
On Tuesday the 13th, Trezor purges resellers from its network to shield its retail distribution chain. The hardware wallet manufacturer stated that the move is a precautionary response to the detection of spyware implants in third-party distributed units of its primary competitor, Ledger.
To the resellers who helped build Trezor: thank you, and I’m sorry 💔 pic.twitter.com/RK7KBJOshp
— Danny (@Dantoshi) October 13, 2026
The leadership of SatoshiLabs, Trezor’s parent company, notified business partners of the termination of multiple authorized reseller agreements. According to the firm’s corporate statement, the company has found no evidence whatsoever of physical tampering or intrusion within its own devices.
Between October 9 and October 11, 2026, reports emerged detailing Ledger units that had been physically altered before reaching the end consumer. Initial technical investigations revealed the presence of spy chips capable of intercepting recovery seed phrases and transmitting data over a cellular connection.
Data from blockchain forensics firm Bitquery suggests that the funds drained from affected users range between $86 million and $103 million, primarily in USDT assets on the Tron network. Ledger traced the confirmed incidents back to Southeast Asian distributor CryptoBilis.
As an immediate operational response, Trezor removed CryptoBilis from its official portal on October 11, 2026. The retailer subsequently suspended all sales of cold storage wallets.
Industry analysts note that third-party resellers represent the most vulnerable attack vector in cold custody. A market report from Traders Union characterized the exclusion of third parties as an operational hardening step against physical logistical vulnerabilities.
Supply Chain Hardening and New Commercial Requirements
Trezor halted shipments of new batches to revoked distributors. However, the company authorized these merchants to liquidate their remaining inventory through the year-end shopping season.
Partners remaining in the official program must sign stricter contractual agreements. Trezor’s official documentation indicates that these distributors will be subject to recurring audits covering storage protocols, traceability, and package handling.
The hardware wallet industry has dealt with repeated logistical incidents throughout 2026. In August 2026, a breach at logistics provider ShipMonk exposed contact information belonging to roughly 81,000 Trezor customers, though private keys and funds remained uncompromised.
Technical security reports from Ledger Donjon had previously warned in March 2025 and June 2026 about the critical need for extreme caution regarding the physical distribution of crypto electronic hardware.
The next operational milestone for the ecosystem will occur on January 1, 2027, when Trezor will publish on its web platform the finalized, pruned registry of authorized distributors for the upcoming calendar year.
