Trezor cuts its authorized dealers: the authorizations end on January 1, 2027

Select what genuinely interests you. Your picks feed directly into our editorial planning.

Crypto news that's actually worth your time.

Weekly. 60 seconds. Carefully curated by our editors: no hype, no promo flood, no spam.

Anyone planning to buy a Trezor hardware wallet before Christmas is buying it on different terms than a week ago. The Czech manufacturer announced on October 13, 2026 that it is sharply cutting its network of authorized dealers. Affected partners receive no further stock from the date of the letter and may sell their remaining inventory only until January 1, 2027. After that they are no longer authorized dealers. The trigger does not lie with Trezor itself but with rival Ledger: there, devices reached the market through one reseller with a foreign radio component built in.

For buyers, that shifts the most important question. What matters is no longer which model supports the most assets, but which route the device travelled into your hand. This article sets out what exactly Trezor announced, what happened at Ledger, which deadlines apply and what marks an authorized supply route.

What Trezor announced on October 13

Trezor published the decision through its channel on the platform X; chief commercial officer Danny Sanders had shared the letter to partners shortly before. According to the report by trade outlet The Crypto Times , the decisive sentence to the dealers being dropped reads: “your authorization ends on 1 January 2027”.

The letter sets out three points. First, Trezor supplies the affected partners with no new stock from now on. Second, those partners may continue to sell existing inventory until the authorization expires at the turn of the year. Third, the remaining partners will work under a revised contractual framework in which Trezor looks more closely at where devices come from, how they are stored and how they are handled.

One point matters for context: Trezor states explicitly that there is no indication of tampering with its own devices. The announcement says there is “not a single piece of evidence that Trezor devices have been compromised”. The cut is a precaution, not a response to a loss of its own. The company also said it would review the decision should the situation change.

Supply chain attack: how the implant at Ledger worked

The trigger is an incident at French manufacturer Ledger. On the company’s account, reported by industry outlet CoinDesk on October 13, devices sold through the Southeast Asian reseller CryptoBilis carried an additional radio component. That component read the 24 words of the recovery phrase off the device display and sent them out over a mobile network, technically through a built-in eSIM.

Ledger describes the case as a physical intervention in the supply chain, not as a hole in its own software or internal systems. That is the heart of the matter and the reason a dealer list suddenly becomes a security question: the encryption inside the device stays intact, while the attack sits one step earlier, at the device itself, before it reaches the customer.

Recovery phrase is the sequence of twelve or twenty-four words from which every private key of a wallet can be recalculated. Anyone who knows it has full access to the balance without holding the device. That is why a hardware wallet shows these words only once, and only on its own display: a display that is being read along defeats the whole protection. How that protection works in the normal case, we took apart in our explainer on the hardware wallet .

On the scale of the losses there are only estimates so far, and they diverge. The research arm of Galaxy Digital put the losses at more than $90 million across several hundred addresses. CoinDesk cited on-chain estimates of up to $93.2 million across more than 300 wallets; stablecoin issuer Tether froze 10 million USDT of that, according to the same report. Ledger itself has confirmed neither the number of victims nor a total. The range of roughly $90 million to $93 million is the state of the estimates, then, not an audited tally. The details of the case and the first reactions we recorded in our report on the Ledger incident .

Trezor removed CryptoBilis from its own dealer list on October 12, a day before the big announcement and, on its own account, as a precaution. The reseller was therefore listed at Trezor as well, without any loss becoming known there.

From a buyer’s point of view the deadline is the most awkward part of the announcement. The dealers being dropped do not lose their authorization at once, but only on January 1, 2027. Until then they may sell down their stock. That means the whole Christmas season and Black Friday still fall under the old order. Trezor names this period in the letter itself, so it is not an accident but a transition deliberately granted to the partners.

For you that has an uncomfortable consequence. Over the coming weeks, devices will sit on shelves and in online shops whose sellers are still formally authorized but will not be from January. A dealer’s status in December therefore says nothing how Trezor will classify that dealer in January. If the shortest supply route matters to you, check the status now and not when the parcel has arrived.

Authorized dealer, marketplace, reseller: the differences

Three terms are often mixed up in retail, and the difference between them decides the risk.

An authorized dealer is a company that has a contract with the manufacturer and sources its goods directly from it. A marketplace is a platform on which many different sellers offer their wares; the operator of the marketplace is not necessarily the seller. A reseller , finally, buys goods and sells them on, with or without a contract with the manufacturer.

The weak point that the Ledger case has exposed sits precisely in that middle. A device that passes through several hands was unpacked, repacked or stored somewhere along the way. The longer that route, the more opportunities there are to alter the hardware. Trezor describes its own requirement of partners on its help pages as goods that come directly from the manufacturer and are kept apart from other products: “Stock is supplied by us directly and kept separate so that devices are not mixed with other goods.”

Which models exist at all and how they differ in handling, you can look up in our comparison of hardware wallets ; the question of the supply route arises in the same way for every one of these devices.

Which supply routes Trezor itself calls safe

On its help page on buying a genuine device , Trezor names its own shop as the best source. Alongside that, the company lists authorized dealers as a legitimate source and points to its own storefront on Amazon. Devices from these channels Trezor calls unproblematic in principle, and for the individual case it points to its own guide on whether a device can be used.

Since October 13 that order has been more than a recommendation. When a manufacturer shrinks its partner network because it does not have enough control over third-party storage routes, buying direct is not merely convenient: it is the option with the fewest stops. Ledger has gone one step further down the same path and sells its new flagship model exclusively through its own shop.

Seals, packaging and firmware: the checkpoints on a new device

An implant inside the case is hard to spot from the outside. Four points still give an indication, and together they cost less than ten minutes.

Packaging. Look at the security seals, the film and any traces of glue before the device comes out of the box. A seal that has already been broken is a reason not to put the device into service.

Weight and gaps. An additional component in the housing changes both slightly. Anyone with a second device of the same model will notice the difference.

First setup. A new device generates the recovery phrase itself. If a phrase is already included, on paper, as a card or as a sticker, the device is no longer new and does not belong in service.

Check by the manufacturer. Both vendors offer a genuineness check through their own software. That check argues against swapped firmware, not against every additional component.

The fourth point is where care is needed: a passed genuineness check proves that the software comes from the manufacturer. A radio component that merely reads along does not touch the software. No check on a powered-up device therefore replaces a clean supply route.

Secure element and seed: the blind spot lies in showing the phrase

The secure element is a chip hardened against read-out that stores the private keys and computes signatures without releasing the keys. That design protects well against attacks over the cable, over the software and through an infected wallet app on the computer.

Against an attack that starts at the display it does not help. The recovery phrase has to be shown to the owner once during setup, otherwise they could not write it down. That single moment is the only one in which the secret leaves the device, and in the Ledger case it is exactly that moment the component read along. The lesson is uncomfortable: the hardening of the chip is not the weakest point of a hardware wallet, the route the goods travel is.

Used hardware wallets: the second-hand market stays unverifiable for buyers

For used devices the situation has been even clearer since October 13: a second-hand device cannot be verified by its buyer. They know neither who opened it before nor whether the packaging belongs to the goods. Both manufacturers have advised against this route for years, and the current case supplies the argument after the fact.

Anyone facing the question of whether a hardware wallet is needed at all will find the alternative in a pure software solution, with its own advantages and drawbacks. A software wallet carries no supply chain risk, but its key sits on a device that is connected to the network.

MiCA and consumer protection: what supervision does not cover for hardware

An obvious question is whether the European crypto regulation MiCA applies here. The answer is no. MiCA governs services around crypto assets, that is trading, custody for third parties, exchange and the issuance of tokens, and for those a provider in Germany needs permission from BaFin. A hardware wallet that you manage yourself is not such a service: nobody holds anything for you, the device is a piece of electronics.

That leaves the purchase under general product and sales law. It gives you warranty rights against the seller, but it does not place a supply chain under supervision. This gap is why the manufacturers have to solve the problem themselves, through contract terms and through the length of their dealer lists, and why their announcements have immediate practical consequences for buyers. How far the loss of trust at Ledger already reaches became visible in German retail.

What is documented in the Ledger case and what remains open

Honesty requires separating the two. Documented is this: Trezor is shrinking its dealer network as of January 1, 2027 and names the incident at Ledger as the reason. Ledger traces the confirmed losses to devices sold through a single reseller and describes the attack as a physical intervention in the supply chain. Trezor took that reseller off its own list on October 12.

Open , by contrast, is the total, because the estimates of roughly $90 million to $93 million come from third parties and are not confirmed by the manufacturer. Also open is how many dealers Trezor is dropping and which countries this affects: the company has given no figure. For buyers in Europe that means the list of authorized dealers remains the only reliable source of information, and specifically the list at the time of purchase.

For anyone watching this and wondering how much caution is appropriate: the attack was elaborate, it hit devices from one particular supply route, and on everything that is public it has affected no model and no manufacturer as a whole. Panic is a poor guide here. A verified supply route, by contrast, costs nothing and closes the gap at issue.

Trezor dealers: until January 1, 2027 the old list still holds

Three steps follow from the announcement, and they build on each other.

Settle the supply route before you pick a model. Direct from the manufacturer or from a dealer who is on the official list at the time of purchase. Which devices qualify is set out in the comparison of hardware wallets .

Weigh up whether a hardware wallet is the right solution. For small holdings a well-secured software solution can be enough; the trade-off is set out in the comparison of software wallets .

Classify the devices you already own. Anyone who owns a device from an unclear source will find the checks and the manufacturers’ response in our report on the confirmed implant at Ledger . Setting a device up again necessarily generates a new recovery phrase.

(As of October 17, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)

Frequently asked questions the Trezor dealer network

Until January 1, 2027. From the letter dated October 13, 2026 Trezor supplies affected partners with no new stock, but allows them to sell down existing inventory until the turn of the year.

Not according to the manufacturer. Trezor says there is not a single piece of evidence that Trezor devices have been compromised, and describes the cut to its dealer network as a precaution.

The estimates range from more than $90 million (Galaxy Digital, several hundred addresses) to up to $93.2 million across more than 300 wallets according to on-chain analyses. Ledger itself has not confirmed a total.

Trezor names its own shop as the best source, alongside authorized dealers and its own Amazon storefront. What counts is that the dealer is on the official list at the time of your purchase.

No. The secure element keeps private keys from being read out, but the recovery phrase is shown once on the display during setup. That is exactly the moment the component intercepted in the Ledger case.

Transparency note: This article was produced with the assistance of artificial intelligence and reviewed by our editorial team before publication. All figures and claims were checked against the primary sources linked in the text. The feature image was generated with AI.

Ledger Hack? $86 Million Drained: What Is Behind the Tampered Wallets From Southeast Asia

Ledger Confirms Implant in a Hardware Wallet as Reports Reach Europe: What Is Behind It

MediaMarkt and Saturn halt Ledger sales after a customer reports an implant

Trezor Hack Scare: That STM32 Entropy Email Is a Phishing Attack

Fake Ledger Site Tops Google : “Once the recovery phrase has been handed over, the wallet must be regarded as compromised”

Which topics should we dive deeper into?

Select what genuinely interests you. Your picks feed directly into our editorial planning.

Crypto news that's actually worth your time.

Weekly. 60 seconds. Carefully curated by our editors: no hype, no promo flood, no spam.

October 16, 2026 4:50 PM

Ledger sells the Atom at $849 through its own shop only: “For years, our customers have been asking us for a Ledger phone”

Ledger presented the Android device Atom on October 15 and sells it exclusively through its own shop. After tampered devices were found in the intermediate trade, the distribution route itself becomes a security question.

October 16, 2026 4:41 PM

Fake Ledger firmware updates: SlowMist reports phishing pages with a replica Genuine Check

A phishing campaign reproduces the sequence of an official Ledger update and asks, at the end, for the 24 recovery words. SlowMist reported it on October 16; Ledger had set out its reading of the underlying implant case a day earlier.

October 12, 2026 10:41 AM

14.7 million swapped into USDD, 20 addresses frozen: what to check with your stablecoin

After the thefts among Ledger buyers, Tether has frozen more than 20 addresses and locked up around $10 million. Because part of the loot was swapped into USDD, the case shows exactly how far a stablecoin's freeze function reaches.

September 16, 2026 4:12 AM

Wallet Drops a Network: How to Rescue Your Coins Before the Deadline

Phantom is ending Sui support on September 24, 2026, and Trust Wallet has already removed 25 networks: five shutdowns of this kind in four weeks alone. What really happens to your balance, which two routes you have before the deadline and where the move most often fails.

December 26, 2025 1:50 PM

Breaking: Trust Wallet Chrome Extension Hack Drains $7M, Full Reimbursements Promised

A supply-chain attack hit Trust Wallet’s Chrome extension, draining $7M from users. Binance’s CZ says all victims will be reimbursed.

October 14, 2026 1:30 PM

What is a hardware wallet? How the device protects your keys

A hardware wallet stores no coins, only the private key, and it never releases it. How signing works inside the device, what the 12 or 24 words mean, and which attacks the design cannot stop.

August 25, 2026 10:31 PM

Crypto Wallet Phishing by Letter: Why the QR Code From Your Postbox Wants Your Recovery Phrase

Letters carrying a QR code urge a supposedly urgent wallet update on grounds of quantum resistance and lead to a page that asks for the recovery phrase. The Federal Office for Cybersecurity reported the ploy on August 18, 2026.

August 13, 2026 4:59 PM

Trezor Data Breach: First 13,689 Customers, Then Roughly 67,000 More Exposed

A breach at Trezor shipping partner ShipMonk exposed names, phone numbers and addresses of 13,689 customers in August; in September Trezor reported roughly 67,000 more in the US. Devices are safe, phishing risk is not.

September 19, 2026 1:23 AM

Hardware wallet lost: how to rescue your coins and what the tax office accepts

Your hardware wallet is gone, your coins are still on the blockchain: all that matters is whether you still have your recovery phrase. What goes wrong during a restore, and why the tax office as a rule does not recognise permanently lost access as a loss under Section 23 of the Income Tax Act.

September 10, 2026 1:14 PM

Phishing Email From the Real Sender Address: How to Check a Wallet Security Warning

An alleged security warning to wallet customers travelled through the manufacturer's genuine sending channel and passed every technical authenticity check. The test that still holds costs you four minutes.

August 22, 2026 4:13 AM

SafePal Data Breach: 39,798 Customers Exposed With Names, Addresses and Phone Numbers

SafePal confirmed a data breach on August 16, 2026: the names, delivery addresses, phone numbers and order details of 39,798 customers were exposed. Seed phrases and private keys were not affected, but the phishing risk is substantial.

August 21, 2026 7:26 PM

Restoring a Seed on Another Manufacturer's Wallet: What BIP39 Guarantees and What It Does Not

Your seed is yours; the device belongs to a company. This article explains what the open BIP39 standard actually guarantees, why a wrong derivation path makes a full wallet look empty, and the test that settles both in twenty minutes.

August 5, 2026 10:33 PM

$130 Million Gone Because the Randomness Was Predictable: Which Hardware Wallet You Can Still Buy

The Coldcard flaw proved the most respected wallet is not the safest. Which vendor has which track record – and why now is the wrong moment to pause your savings plan.

October 17, 2026 10:44 PM

Creating a Bitcoin wallet: the first ten minutes decide who has access

A Bitcoin wallet is set up in ten minutes, and that is precisely the danger. Which four steps every setup runs through, why the first transfer should be a test amount, and which five mistakes cost the most.

September 17, 2026 4:14 PM

D'CENT App Wallet: How to Tell If Your Recovery Phrase Has to Move Now

Manufacturer IoTrust reports suspicious asset transfers in the D'CENT app wallet and asks users to move their holdings. One question decides the matter: has your recovery phrase ever been entered into the app?

August 11, 2026 1:32 PM

How to Store a Seed Phrase Safely: What Steel, a Passphrase and Multisig Do for Your Wallet Backup

The Coldcard case pushed the manufacturer question to the front, while barely touching on where the backup is kept. This guide places paper, steel, the passphrase and splitting methods against the BIP-39 and SLIP-0039 standards.

September 23, 2026 4:12 AM

How to Set Up a Crypto Wallet: Securing Your Coins in Seven Steps

Your own crypto wallet is set up in twenty minutes, yet a single step decides everything that follows. This guide takes you through wallet type, recovery words and the test amount, and sets out what BaFin and the tax office expect.

October 2, 2026 10:36 AM

Hot Wallet or Cold Wallet: the Private Key Decides How Safe Your Coins Are

Hot wallet or cold wallet: the difference rests solely on whether the private key is online. What separates the two forms, where the limits of hardware lie and why moving to your own device triggers no tax.

September 30, 2026 7:16 AM

Tangem Wallet: The Card Without a Seed Phrase vs the Classic Hardware Wallet

The Tangem Wallet secures crypto with two or three identical cards instead of 24 words. What the sets cost, what the EAL6+ chip delivers and why losing every card is final.

September 4, 2026 10:15 PM

Trezor Data Breach: Am I Affected and What Should I Do Now?

Trezor widened the ShipMonk data breach on September 4, 2026: around 67,000 further people affected, just over 80,000 in total, from orders placed between November 2019 and August 2021. How to check in two minutes whether you are among them, and what an exposed address means for self-custody.

September 4, 2026 10:17 AM

Cypher Shutdown on September 6: What Users Should Know Now the Withdrawal Deadline Has Passed

Recap as of September 27, 2026: Cypher had announced it would take its app, dApp and withdrawal window offline on September 6, 2026 and end the token protocol. This article describes the situation before the deadline, how the payout worked and what our own measurement showed at the time what was left of the CYPR token.

October 6, 2026 4:29 PM

Setting up MetaMask: the twelve words that control your coins

MetaMask is set up in ten minutes, and in those ten minutes you make the decisions that later determine what happens to your balance. This guide walks through installation, the recovery phrase, networks, approvals, fees and the German tax position.

September 20, 2026 4:15 PM

Crypto Phishing After a Data Breach: The Warning Signs in a Fake Exchange Email

After every major data breach, the number of phishing emails sent in the name of crypto exchanges and wallet manufacturers rises. This article shows you how to recognise such a message, which data a reputable provider never requests by email, and what to do in the first hour after a click.

September 1, 2026 7:27 AM

Clipboard Attack: How Malware Swaps the Wallet Address You Copied

A clipper replaces the receiving address between copying and pasting with the attacker’s, and your wallet’s checksum notices nothing. What Microsoft and the Federal Office for Cybersecurity have documented, and which check really makes the attack come to nothing.

November 2, 2021 11:14 AM

Comparison Between Ledger And Trezor Wallet

A crypto wallet works just like your physical wallet, but is also virtual. In this article, we will be looking at the Ledger and Trezor Crypto Wallets.

December 22, 2020 3:49 PM

Crypto Wallet Provider Ledger Hacked: Data Leak Results in Phishing Scams

Ledger, a cryptocurrency wallet provider has encountered a data breach. The official Twitter account of the hardware wallet tweeted that they have been alerted to the dump of a client database.

December 28, 2018 3:02 PM

How To Use a Trezor Wallet?

Trezor is a hardware wallet which gives exceptional security for managing Bitcoin and other cryptocurrencies private keys.It incorporates and deposits personal keys securely and enables users to carry trade without an Internet link. Trezor grants its users with numerous benefits, […]

More from CryptoTicker