Trezor Stands Firm on User Security Amid Ledger's Tampering Incident

Trezor, a prominent hardware wallet manufacturer, has made a clear statement rejecting any notion of opportunism following a significant security incident involving competitor Ledger. The incident, which occurred between October 9-11, 2026, involved tampered Ledger devices sold by Southeast Asian reseller CryptoBilis, leading to an estimated loss of $86 million to $103 million from various wallets.

In response to the crisis, Trezor emphasized that it prioritizes user security and has not received reports of compromised devices from CryptoBilis. The company reiterated its commitment to collaborating with industry partners to enhance security measures and urged users to purchase devices through official channels.

While Trezor has avoided capitalizing on Ledger's misfortune, it is not without its own challenges. In late September 2026, Trezor disclosed a data breach affecting approximately 81,000 customers, although it maintained that the integrity of its devices was not compromised.

The ongoing situation highlights the need for standardized anti-tamper practices in the hardware wallet industry, as both Trezor and Ledger face scrutiny over their supply chains. The CryptoBilis incident serves as a reminder that trust is paramount for hardware wallet users, and both companies must work to restore confidence in their products.

New Developments in Ledger Incident

MediaMarkt, an official European Ledger reseller, has halted sales of Ledger wallets due to reports of devices potentially being fitted with physical spyware. This decision follows an incident where wallets sold by Malaysian reseller CryptoBilis were drained of $86 million.

Mark Karpelès, former CEO of Mt. Gox, is assisting in identifying spyware in various Ledger wallets. He has discovered spyware in wallets sold by MediaMarkt, LazMall in the Philippines, CryptoBilis, and a wallet sold at Metapod in Singapore's airport.

Despite these findings, Ledger has only confirmed that the wallets sold by CryptoBilis were involved in the draining incident and has not linked other resellers to the $86 million loss. The company is currently investigating the tampered devices sourced from CryptoBilis, noting that the spyware could record a wallet's 24-word recovery phrase and transmit it via an attached eSIM.

As the investigation continues, CryptoBilis has ceased selling wallets.

Latest Developments on Trezor's Security Measures

• Trezor announced on October 13, 2026, that it is reducing its authorized reseller network due to supply-chain tampering concerns.
• CryptoBilis, a reseller linked to significant tampering incidents involving Ledger devices, was removed from Trezor's seller list on October 11, 2026.
• Ledger has reported hundreds of wallet drain incidents associated with devices sold through CryptoBilis, with estimated losses between $86 million and $103 million.
• Trezor plans to refresh its resellers page after the New Year, indicating a more selective group of authorized partners.
• In August 2026, a breach at logistics provider ShipMonk exposed personal information for up to 81,000 Trezor customers, although no wallet keys or funds were compromised.
• For current Trezor users, the company asserts that there is no evidence of tampering with their devices, while prospective buyers are encouraged to purchase from verified sources only.

Trezor's Response to Security Concerns

Trezor is significantly reducing the number of authorized retailers selling its hardware wallets in response to a recent supply-chain attack involving a competitor's product.

Following a security incident where a Ledger wallet sold by a third-party retailer was found to contain spyware, Trezor has taken proactive measures to ensure the safety of its devices. The spyware was designed to capture the 24-word recovery phrase during setup, posing a serious risk to users' crypto assets.

Trezor has emphasized that there is no evidence of any compromise of its devices. The company has terminated partnerships with certain resellers, effective January 1, 2027, and has ceased shipping new stock to these partners while allowing them to sell existing inventory through the holiday season.

Chief Commercial Officer Danny Sanders highlighted that the decision was based on various factors including revenue and distribution in each country. Trezor is implementing stricter checks on how devices are sourced, stored, and handled by remaining partners.