Trezor Ends Some Reseller Authorizations After Wallet Implant

Trezor will end authorizations for some resellers on Jan. 1, 2027, tightening distribution controls after an unauthorized implant was found in a wallet sold by CryptoBilis and was capable of capturing recovery phrases.

Trezor will stop shipping new inventory to affected resellers, which can continue selling existing stock through the holiday season before the authorizations expire. The company has not disclosed how many resellers are affected or which markets will lose authorization.

The implant was found in at least one wallet sold by Southeast Asian retailer CryptoBilis. It read 24-word recovery phrases from device screens and transmitted them over LTE through an embedded eSIM. The implant did not alter the wallet’s Secure Element, operating system, transactions or signatures.

A recovery phrase can restore access to a crypto wallet. Ledger warned CryptoBilis buyers not to initialize unused devices and advised users of initialized devices to move funds to a new wallet with a newly generated phrase.

On-chain investigator Specter estimated more than $86 million in suspected losses, but the figure remains unconfirmed. Reports of implants involving other retailers have not been linked to the CryptoBilis incident.

Trezor said there is “not a single piece of evidence” that its devices were compromised. The reseller authorizations end Jan. 1, 2027.