Trezor is tightening its reseller network following the Ledger supply-chain incident, while rejecting claims that similar tampering has been confirmed in its wallets.
Trezor has responded to growing hardware-wallet security concerns by reducing its reseller network, while stating that it has no evidence its devices have been compromised.
The October 13 statement followed a social-media post from DelCrxpto claiming that the Ledger incident had extended to Trezor and that tampered Trezor devices had been found. The post urged users to abandon the wallets. That claim is not established by the evidence reviewed for this article. DelCrxpto’s post.
Trezor’s subsequent statement was explicit:
“There is not a single piece of evidence that Trezor devices have been compromised.”
The company said it was reducing the number of resellers so it could check its remaining partners more effectively, describing the decision as preventive. Trezor’s official statement.
CryptoBilis removed as a precaution
Trezor had already addressed the issue on October 12, saying it had received no reports of tampered Trezor devices from CryptoBilis and had no indication its devices were affected.
Nevertheless, it removed CryptoBilis from its reseller list and stopped Trezor sales through that channel as a precaution. Trezor’s October 12 response.
These actions show that the Ledger incident is influencing security decisions across the hardware-wallet industry. They do not amount to confirmation of a Trezor hardware hack.
That distinction matters for users deciding what to do with their savings. A precautionary distribution change, a reported physical implant and a verified theft are different findings. Treating them as interchangeable can encourage rushed decisions.
Previous customer-data exposure is a separate issue
Trezor has disclosed other security incidents involving third-party providers. In its ShipMonk disclosure, updated September 4, it said customer order information had been exposed, including contact details and shipping addresses.
Trezor stated that its own systems and devices were unaffected, but warned that the stolen information could support targeted phishing emails, fraudulent calls and physical letters. That customer-data breach is separate from the current allegation of hardware tampering. Trezor’s ShipMonk disclosure.
The distinction does not make leaked personal information harmless. A criminal who knows someone purchased a hardware wallet has useful information for impersonating support and crafting a convincing approach.
AI makes verification more important
The broader cybercrime threat is becoming harder to manage. The UK’s National Cyber Security Centre expects AI to improve attackers’ efficiency and increase the frequency and intensity of cyber threats. Its assessment identifies uses including reconnaissance, social engineering and basic malware generation. NCSC assessment.
There is no verified evidence that AI played a role in the alleged Trezor incident. The concern is that increasingly capable tools can help criminals exploit fear around real security events.
An urgent message telling users to “secure” their wallet by entering a recovery phrase may itself be the attack. Users should open the provider’s official website independently and verify instructions there.
Protect your holdings without reacting blindly
Trezor advises concerned users to contact its support team and avoid forcing devices open, warning that doing so can damage them and that the Safe 7’s battery creates an additional risk. Its firmware-authenticity guidance also tells users to stop using an uninitialized device if an authenticity check fails and contact support. Trezor’s handling advice, authenticity-check guidance.
For long-term holders, the wider lesson is to avoid concentrating everything in one wallet, one recovery phrase or one custody arrangement. Two devices restored from the same phrase provide access to the same wallet; they do not create independent protection against that phrase being stolen.
Separating everyday spending from long-term savings can limit exposure. More advanced arrangements, such as multisignature custody, require careful setup and recovery planning.
Trezor’s current position is that there is no evidence of compromised devices. Users should take that statement seriously while continuing to verify new information. With AI expected to strengthen cybercriminal capabilities, security habits need to improve before the next incident—not only after funds disappear.
Related coverage
Ledger Wallet Tampering Reports Reach Europe as MediaMarktSaturn Suspends Sales.
Cover image: AI-generated editorial illustration. It does not depict a confirmed tampered device.
