Trezor: ‘Supply chain security is never finished’ – Tightens reseller checks after Ledger supply chain scare

Trezor will cut its third-party reseller program by January 2027 in response to the Ledger supply chain attack. 

The Ledger hardware wallet exploit via spy implants has hit $100M in losses. Most of the victims bought the tampered wallets from reseller CryptoBillis.

But the compromised resellers and regions could be far-reaching beyond Asia. This has forced rivals to re-evaluate their distribution lines and resellers. 

In a statement, Danny Sanders, Chief Operating Officer (COO) at Trezor, said,

This is a preventive step, taken out of an abundance of caution.

He added,

Supply chain security is never finished, so we are raising the bar for every partner who continues with Trezor, with an updated legal framework and closer checks on how devices are sourced, stored, and handled.

Sanders said Trezor had received no reports of compromised devices and described the move as a precautionary measure.

Ledger supply-chain fallout forces rivals to cut resellers

Yishi Wang, founder of another crypto hardware wallet firm, OneKey, also made a similar announcement. It axed 95% of its resellers. 

Wang added that OneKey had paused shipments to all resellers while reviewing its third-party distributors.

The scare followed reports that CryptoBillis had been sold earlier this year to an unnamed Chinese firm. Its former owners said a non-disclosure agreement prevented them from revealing details of the sale.

Reports linked affected devices to spy implants that captured seed phrases and transmitted them to a remote server.

Access to those phrases could allow attackers to drain users’ funds without possessing their wallets.

The concern extended beyond CryptoBillis, although the full scope of compromised distribution remained unclear. Ledger urged resellers in Southeast Asia and Hong Kong to pause hardware wallet sales.

The firm said it was yet to verify claims that the drain had spread beyond Southeast Asia. 

In less than three months, over $200M has been siphoned off hardware wallets (Coldcard and Ledger). This has cast doubt on self-custody security. 

To minimize the risks, some players such as BitGo have begun offering free custody services to retailers. It leverages a multi-signature setup typically used by institutions that ensures a single failure can’t move funds on its own. 

That said, like Coldcard, there is a low chance of victim compensation from Ledger. 

Final Summary

• Trezor and OneKey have cut third-party resellers to avoid a supply-chain attack. 
• As hardware wallet losses hit $200M, BitGo has offered free custody services to retail investors