--- title: "Trezor Slashes Reseller Network by 80% Following Spyware Discoveries" description: "Hardware wallet maker Trezor drops non-compliant vendors and issues a firmware patch after finding tampered Safe 5 devices sold by CryptoBilis." url: https://basisdesk.news/news/trezor-cuts-resellers-spy-implants-cryptobilis published: 2026-11-12T18:36:28.659Z modified: 2026-11-12T18:36:28.659Z section: Security & Hacks author: Basis Desk Newsroom (AI-generated, source-verified) sentiment: bearish tickers: [BTC, ETH] tags: [trezor, hardware-wallets, security, supply-chain, cryptobilis] license: Quote with attribution to Basis Desk (basisdesk.news). Not financial advice. --- # Trezor Slashes Reseller Network by 80% Following Spyware Discoveries Hardware wallet maker Trezor drops non-compliant vendors and issues a firmware patch after finding tampered Safe 5 devices sold by CryptoBilis. ## At a glance - **What happened:** Trezor cut 80% of its reseller network after discovering hardware spy implants in three Safe 5 devices sold by Malaysian vendor CryptoBilis. - **Why it matters:** The move tightens hardware wallet distribution security following an $86 million theft affecting rival Ledger through the same vendor. - **Who is affected:** Customers who purchased Trezor Safe 5 devices from CryptoBilis between Aug. 20 and Sept. 23, and discontinued Trezor resellers. - **Takes effect:** 2026-11-11 - **What's next:** CryptoBilis customers must transfer funds to new backups while Trezor distributes free replacement units. - **Status:** announced - **Primary source:** [Trezor cuts reseller network by 80% after finding more spy implants](https://protos.com/trezor-cuts-reseller-network-by-80-after-finding-more-spy-implants/) — protos.com ## Key points - Trezor removed 80% of its third-party reseller network after enforcing stricter supply chain and storage protocols [1]. - Three Trezor Safe 5 units sourced from Malaysian reseller CryptoBilis were confirmed to contain hardware spy implants [1]. - A Nov. 11 update alters display command sequences to block capture triggers, though users are urged to migrate funds [1]. ## Editorial remark - **Context:** Supply chain vulnerabilities resurfaced after Malaysian vendor CryptoBilis was tied to an $86 million theft from Ledger devices, prompting industry-wide audits of hardware integrity. - **Impact:** Trezor customers who bought units from CryptoBilis between Aug. 20 and Sept. 23 must generate new seeds, while the firm's global retail distribution footprint shrinks by 80%. - **Watch:** Whether additional tampered units appear across other regional resellers and if compromised funds surface on-chain from the affected Trezor devices. Hardware wallet manufacturer Trezor reduced its authorized reseller network by 80% after identifying additional hardware spy implants in devices distributed by Malaysian vendor CryptoBilis [1]. The manufacturer introduced stricter supply chain guidelines concerning how hardware units are sourced, stored, and accessed, leaving only 20% of its previous retail partners compliant with the updated standards [1]. Trezor noted that the eliminated resellers were considered trustworthy and did not present an active security risk [1]. Trezor confirmed that three Trezor Safe 5 units purchased between Aug. 20 and Sept. 23 were found with the unauthorized implants [1]. According to a company spokesperson, the implant was designed to monitor communications between the microcontroller unit (MCU) and the display, triggering data capture upon detecting the sequence corresponding to a wallet seed phrase [1]. Trezor rolled out a firmware update on Nov. 11 that alters the command sequence transmitted to the display, which the firm states neutralizes the implant mechanism without altering visual output [1]. ## Supply Chain Risks Despite the software mitigation, Trezor advised CryptoBilis customers to transfer their funds to entirely new wallets, emphasizing that firmware adjustments cannot protect seed phrases that were compromised prior to the release [1]. The company stated that no digital assets have been stolen from the affected Trezor units and offered complimentary replacement devices to affected CryptoBilis buyers [1]. The discovery follows a related supply chain compromise involving hardware wallet competitor Ledger, whose users lost more than $86 million in October to tampered devices distributed by the same vendor [1]. Ledger's investigation linked that exploit to an organized criminal operation managing extensive logistics, collector servers, and money-laundering channels [1]. At the time of writing, broader digital asset markets were under pressure, with $BTC trading at $71,946 and $ETH at $2,021. ## FAQ **Which Trezor devices were found with spyware implants?** Trezor identified three Trezor Safe 5 units purchased from Malaysian reseller CryptoBilis between Aug. 20 and Sept. 23 that contained hardware spy implants. **Were any cryptocurrency funds stolen from Trezor users?** Trezor maintains that no cryptocurrency has been stolen from the affected devices, though affected users are instructed to transfer assets to new wallets. ## Sources 1. [Trezor cuts reseller network by 80% after finding more spy implants](https://protos.com/trezor-cuts-reseller-network-by-80-after-finding-more-spy-implants/) — protos.com, 2026-11-12 --- Basis Desk Newsroom · AI-generated, source-verified · https://basisdesk.news/about/how-we-use-ai