Trezor drops part of its reseller network and MediaMarkt halts Ledger sales: what changes for hardware wallet buyers

What Trezor announced

On Tuesday, October 13, at 13:32 UTC, Trezor posted on X that it is reducing the number of its resellers so it can vet the ones that remain more thoroughly. Two minutes earlier Danny Sanders, the company's Chief Commercial Officer, had published the letter sent to partners. Its main points:

• resellers who received the letter lose their authorization on January 1, 2027;
• they get no new shipments from the date of the letter;
• remaining stock can be sold until January 1, so Black Friday and the holiday season will go ahead as usual;
• the partners who stay will get an updated agreement and stricter checks on where devices come from, how they are stored and whose hands they pass through.

Sanders explains that the network has to become small enough for the company to vet everyone left in it. He says the decision is no judgment on any particular seller's business or on the security of the devices: countries were reviewed one by one, with a count of how many partners could realistically be supervised. Trezor did not say how many resellers are losing their status or in which countries. The company promises to revisit the decision if circumstances change.

Trezor stresses separately that there is no evidence at all of anyone tampering with its devices and that the step is a precaution. CryptoBilis, the Kuala Lumpur reseller that sold wallets in Malaysia, Indonesia and the Philippines and where the whole story began, was removed from the company's list back on October 12. No complaints have come in about Trezor devices bought from that seller.

What Ledger said about the implant

The same day Ledger Donjon, the company's security team, described for the first time the implant found in wallets from CryptoBilis. According to the team, a separate module sits inside the case and reads the data going to the screen. When the wallet shows the 24 words during initial setup, a microcontroller recognizes them and sends them over an LTE cellular network through a pre-provisioned eSIM.

The secure chip, the operating system, transactions and signatures are left untouched. That is why the wallet looks intact and behaves as usual. We have already covered how Ledger confirmed a hardware implant in a wallet from CryptoBilis and why the authenticity check misses a scheme like this.

What else Ledger said:

• all confirmed thefts are tied to devices sold through CryptoBilis;
• the company is looking into reports of implants in wallets from other sources but has not confirmed any thefts linked to them;
• there are no signs of a breach of its own infrastructure or services;
• the loss figures circulating online were calculated by third parties, and Ledger has not verified them.

The estimates are as follows: the researcher Specter counted more than $86 million, while Bitquery puts the figure at about $92.9 million from 311 wallets, roughly $70.5 million of it on the TRON network. A seed phrase displayed by such a wallet is compromised for good, and the only remedy is a new device with a new phrase. During the move the coins can be transferred as they are or converted right away through a crypto exchange that pays out to the new address.

MediaMarkt halts Ledger sales in Europe

The story has spread beyond Southeast Asia. Since October 13 MediaMarktSaturn, one of Europe's largest consumer electronics chains, has not been selling Ledger either in stores or on its website: a buyer from Germany reported finding an implant in a device. A spokesperson for the chain told The Block that the company is taking the case very seriously. Ledger clarified that no funds were lost in this case.

Other reports are circulating that nobody has confirmed. On Friday, October 9, an X user going by the name Johannes wrote that he had found extraneous wires and cellular modules in two Ledger devices from different MediaMarkt stores. On Tuesday former Mt. Gox CEO Mark Karpelès reported an implant in a Ledger Flex bought at Singapore's airport. Ledger has not confirmed any link between these finds and CryptoBilis.

What to do if your wallet came from a middleman

Ledger's advice is addressed to CryptoBilis customers, but the logic works for anyone who has doubts about their device:

• do not power on or set up a wallet that has not been set up yet; write to the manufacturer's support;
• treat a wallet that has been set up as compromised: create a new wallet with a new seed phrase on a device bought directly, and move the coins there;
• if the money is already gone, contact the police and support first, and only then decide whether to open the case;
• do not take the device apart yourself unless you have to: Ledger has published inspection instructions but warns that this can damage the wallet, while Trezor asks outright that users leave the case closed and contact support.

Carrying the old phrase over to a new device achieves nothing, because the words themselves were stolen and fresh hardware does not change that. How to write down a new phrase and where to keep it so that neither a camera nor the cloud ever sees it is covered in our guide on how to store a seed phrase.

The panic around implants is already being turned into money. Ledger reminds users that it never calls, never writes first and never asks for the phrase. The recent phishing post from Coldcard's account about an "urgent migration" showed that a fake call to action can come even from a manufacturer's real account.

How to move coins to a new wallet and swap them without registration

A move to a new seed phrase is a good moment to tidy up: gather leftovers from different networks into one coin and receive it straight at the new wallet's address. There is no need to open an account on a trading platform and keep coins there for this.

VertEXchange asks for no account, email or phone number to make a swap. You pick a pair, enter the address of the new wallet and see the rate and the amount before sending, and the coins arrive straight at your address. That way you can swap USDT TRC20 to bitcoin without an account or convert ether to bitcoin with the payout going to a new wallet.

• A fixed rate holds for about 15 minutes, enough time to send the transfer without rushing.
• VertEXchange does not hold your coins: the payout goes to the address you specify.
• If the swap does not go through, the coins return to the refund address.
• Personal fields of the operation are deleted 24 hours after it completes, and the swap history stays only in your browser.
• A support chat is on every page, and questions are resolved by the swap code.

FAQ

What changes at Trezor on January 1, 2027?

Resellers that received the company's letter will lose their status as authorized sellers. New stock is already no longer shipped to them, and what they have left can be sold until the end of 2026. The partners that stay face an updated agreement and stricter checks.

Why is Trezor cutting resellers if its devices have not been compromised?

The company calls it a precaution after the Ledger and CryptoBilis story. According to Chief Commercial Officer Danny Sanders, the network should be of a size that allows every partner to be vetted.

How did the implant in Ledger wallets work?

According to Ledger Donjon, a module inside the case read the data going to the screen. During setup it recognized the 24 words and sent them over an LTE network through an eSIM. The implant did not touch the secure chip or the firmware.

Why did MediaMarkt stop selling Ledger?

A buyer from Germany reported an implant in a purchased device. On October 13 MediaMarktSaturn halted sales in stores and online. No loss of funds has been reported in this case.

Is it safe to buy a hardware wallet from a reseller?

The risk is higher than when buying from the manufacturer: the device passes through extra hands. The CryptoBilis implant did not alter the firmware, so the standard authenticity check did not notice it. The most reliable option is to order from the manufacturer's website.

What should I do if my seed phrase may have leaked?

Create a new wallet with a new phrase on a device bought directly and move all your coins there. The old phrase stays dangerous for good, even if the money is still in place for now.