The holiday shopping season is approaching, and a high-tech security gadget comes with a new seller check this year. Trezor is cutting its authorized reseller network after an attack on anoth
The holiday shopping season is approaching, and a high-tech security gadget comes with a new seller check this year.
Trezor is cutting its authorized reseller network after an attack on another hardware wallet brand.
The letter is signed by Chief Commercial Officer Danny Sanders. Sellers receiving it will lose their authorization on Jan. 1, 2027.
Related: Mark Cuban-backed platform to shut down
Trezor says the change is preventive. It has found no evidence that its own devices were compromised.
Sanders says the company wants fewer partners so it can check each one more closely. Remaining sellers will face stricter oversight of their stock.
"There is not a single piece of evidence that Trezor devices have been compromised," Sanders wrote."This is a preventive step, taken out of an abundance of caution."
Sanders also apologized to affected sellers for the impact on their businesses.
"I know what that means for a small business... I am sorry. This decision says nothing about your effort or the way you represented us," he wrote in the letter.
The apology addresses the business impact. It is not an admission that Trezor devices were compromised.
A hardware wallet is a small electronic device used to control cryptocurrency, such as Bitcoin. Think of it as a digital key holder rather than a purse full of coins.
Watch our explained below to understand hardware wallet better.
What is a cold wallet? Ledger Stax review (4:25)Trezor's hardware-wallet guide explains that it keeps access to crypto offline. The device protects the secret codes, called private keys, that let an owner authorize spending.
Those keys matter because they control access to the money. Keeping them off an internet-connected phone or computer reduces exposure to online attacks.
The alternative is leaving cryptocurrency with an exchange, a company that lets customers buy and sell it. In that arrangement, the exchange controls the private keys.
Customers depend on the exchange to protect their holdings and keep access available. Holding the keys yourself is called self-custody. It means taking responsibility for access instead of asking another company to do it.
A wallet backup is the other part of that responsibility. During setup, a device generates a list of words that can restore access if the device is lost or damaged.
The number of words depends on the backup system. Trezor's backup guide describes 12-, 20- and 24-word versions.
With a single-share backup, anyone who steals that list can access the wallet using another device. Protecting the gadget is therefore only part of protecting the money.
Trezor says never to share the backup or keep digital copies, including photographs. It also says its support staff will never ask for those words.
Archival photo of two Trezor One wallets beside a physical bitcoin collectible. The devices hold access keys, not coins.Photo credit Gage Skidmore / Wikimedia Commons, CC BY-SA 3.0.Trezor says the risk lies in the path a wallet takes to its owner. In the partner letter, Sanders says every device passing through hands the company cannot properly check puts someone's savings at risk.
The response is a smaller reseller network. Trezor wants to vet and check every remaining partner, with closer oversight of how devices are sourced, stored and handled.
This is a preventive step, not a response to evidence that Trezor devices were compromised. The letter says an attack on another hardware wallet brand confirmed the need for tighter checks.
That concern is about physical tampering before a product reaches the buyer. A device can look normal even if someone has added hardware during its journey through the supply chain.
A separate Ledger case illustrates the risk. CoinDesk's Oct. 13 report described an unauthorized implant inside devices sold by Southeast Asian reseller CryptoBilis.
The implant read recovery words from the screen during setup, then sent them to an attacker over a mobile phone network. Stealing those words gave the attacker a route to the funds without taking the wallet itself.
Ledger probes wallet drains involving CryptoBilis buyers (1:45)Ledger described a physical supply-chain attack, not a breach of its software or internal systems. It said the implant did not change its operating system or the security chip protecting private keys.
The report cited researchers' estimates of up to $93.2 million in losses across more than 300 wallets. Ledger had not confirmed the total victim count or the amount stolen.
It also said electronics retailer MediaMarkt Saturn stopped selling Ledger devices after a customer reported an implant in Germany. That report was being examined separately.
Ledger said every confirmed loss in the Oct. 9 incident involved a device sold by CryptoBilis. It advised customers with unused units from that reseller not to set them up.
Customers who had used those units were advised to transfer assets to a new device with a new recovery phrase. That advice concerns the affected Ledger purchases, not Trezor owners.
The Trezor letter does not name the brand involved in the attack it cites. It does not establish that the Ledger incident triggered this decision.
The average loss across all incidents was $3.82 million, compared with a median of $138,703. A few large attacks can dominate the totals.
After frozen and returned funds, CertiK put losses at about $1.2 billion.
Trezor's authorized reseller page lists 87 reseller entries across 44 countries, as read on Oct. 13. Some sellers appear in more than one country, so there are 80 distinct names. Four entries are in the United States: Amazon USA, Best Buy, Casa and Unchained Capital. Two are in Canada: Amazon Canada and Quickbit Crypto Boutique.
Those are counted figures. The letter does not say how many sellers will be removed or where.
Sanders says the company may review the decision if circumstances change.
For buyers, the first check is where the device came from.
Related: Roundtable 100 analysts move PayPal up 56 spots in new power ranking
