DeFi Safety · Fact checked

Trezor Cuts Its Resellers After Ledger Finds Spy Implant in Crypto Wallets

Trezor is ending reseller authorizations on January 1, 2027, after Ledger confirmed that wallets sold by a Southeast Asian retailer carried a hidden implant that sent out users' recovery phrases.

By DeFi Tools Guide Editorial Team · Published Oct 13, 2026, 4:14 PM UTC · Updated 2026-10-13 · Risk level: medium

Sources checked: Oct 13, 2026, 7:01 PM UTC

This article may contain affiliate links. Commercial relationships are disclosed in the affiliate policy.

DeFi Safety — illustration keyed to this article's identifier. Source documents are listed under Sources and are not reproduced here.

What happened

Trezor is ending reseller authorizations on January 1, 2027, after Ledger confirmed that wallets sold by a Southeast Asian retailer carried a hidden implant that sent out users’ recovery phrases.

Reported details

TL;DR: Estimates from on-chain analytics firms like Bitquery place losses linked to the compromised Ledger wallets at over $93 million. On October 11, 2026, Trezor delisted distributor CryptoBilis from its commercial directory and confirmed the halt of new inventory shipments to terminated partners. The company set January 1, 2027, as the deadline for its new … Read more

Why this matters

Whether Trezor reaches the custody and settlement layer depends on what it actually names. If it points at a custodian, a redemption term or a withdrawal rule, that is the layer where exposure lives, and the name and its timing are the parts worth checking. If it names none of those, this angle simply does not apply here, and reading custody risk into it would be an assumption rather than a finding.

Evidence boundary

The scope is limited to what the linked reports state, and where two of them diverge both positions are recorded without either being picked in advance.

What to verify

If Trezor names a custodian or a redemption term, check that name and its timing against the operator’s own documentation; if it names neither, there is nothing here to verify on that layer.

Sources and editorial check time

Decrypt: https://decrypt.co/380848/trezor-cuts-resellers-ledger-finds-spy-implant-crypto-wallets
Crypto Economy RWA: https://crypto-economy.com/trezor-purges-resellers-after-93m-ledger-security-nightmare/
Editorial source check time: 2026-10-13T19:01:34.694Z

This information is educational and is not financial, legal, or tax advice.