Key Notes
- Trezor will reduce its reseller network, with authorization for recipients of its distributor notice ending on January 1, 2027.
- OneKey has revoked CryptoBilis’s authorization, paused new reseller onboarding and offered eligible buyers free replacements.
- Trezor reports no evidence of compromised devices, while OneKey says it has received no related reports of users losing assets.
Trezor will reduce its reseller network following hardware-wallet supply-chain incidents, while OneKey has ended CryptoBilis’s authorization and offered replacements to eligible buyers. The decisions extend the industry response to the Ledger investigation into the distribution channels used to sell security devices.
Trezor outlined its decision in an October 13 statement shared by its community specialist, accompanied by a distributor letter from Chief Commercial Officer Danny Sanders. OneKey’s separate notice, dated October 12, says CryptoBilis is no longer an authorized reseller.
Both manufacturers framed their actions as precautions. Trezor said it had no evidence its devices were compromised; OneKey said it had received no reports of its users losing assets in connection with the incident.
Trezor Sets a January Deadline for Affected Partners
Sanders’s letter says the reseller network will become small enough for Trezor to check every remaining partner closely. The company assessed individual countries, weighing distribution and revenue against its own presence and ability to serve buyers.
For recipients of the letter, authorization ends on January 1, 2027, when they will be removed from Trezor’s authorized-reseller list. The notice says further stock will not be shipped to those partners, while existing inventory can be sold through the transition period, including the holiday season.
The deadline applies to recipients of the termination notice, rather than establishing an end to all third-party Trezor sales. The company has not specified a final number of partners in the public statement.
The letter also says termination is not a judgment about the recipient’s business or the safety of its devices. Partners that remain will face an updated legal framework and closer checks on how products are sourced, stored and handled.
OneKey Removes CryptoBilis and Rechecks Its Network
OneKey has paused new reseller onboarding and is reviewing existing partners. It says unverifiable businesses or unclear ultimate beneficial ownership will lead to authorization being revoked.
Its replacement program covers any OneKey model purchased through CryptoBilis from March 1 through the October 12 statement, whether used or unopened. Applications are due by December 31, 2026.
Buyers must supply proof of purchase, the model and activation status through support on OneKey’s official website. Replacements ship directly from OneKey without requiring the old unit back; unavailable models will receive a newer replacement at no charge.
OneKey links the March start date to a former CryptoBilis co-founder’s account of a management handover. CoinScreamer’s ownership report examines that statement, which does not establish who modified the affected Ledger devices.
What Ledger Has Confirmed
Ledger’s October 11 company update said the confirmed cases in the draining incident disclosed two days earlier involved devices sold through CryptoBilis. It described the impacted volume as limited and said its own systems and direct sales channels were unaffected.
Our implant coverage followed Ledger’s confirmation of unauthorized hardware in an affected customer’s device. The company has not published a verified aggregate loss figure or established that an implant caused every reported theft.
Separate researcher findings require their own attribution. CoinScreamer’s Singapore Airport report covers Mark Karpelès’s examination of a Ledger Flex he says was bought there. That inspection does not, by itself, prove a shared distribution path with CryptoBilis or implicate other wallet brands.
The reseller changes address oversight of the route from manufacturer to customer. They do not establish that every device sold by a removed partner was modified, or that retailer staff took part in tampering.
Authenticity Checks Have a Defined Scope
Ledger’s security team explains in its threat model that Genuine Check authenticates the secure element’s cryptographic identity. A genuine component can remain present even when separate spying hardware has been added around it.
That limitation helps explain why supplier controls matter alongside device authentication. Verifying the original chip answers a different question from checking every component or establishing the complete custody history of a physical device.
The new policies therefore change commercial relationships and inspection requirements while investigators continue determining the scope of the Ledger incident. Trezor’s transition gives affected partners a defined exit date; OneKey’s response combines a network review with a direct replacement route for eligible CryptoBilis customers.
Disclaimer: CoinScreamer is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and market insights on digital assets and related technologies. NuvexMedia LLC invests in and collaborates with companies across the digital asset, blockchain, and technology sectors. These relationships do not influence CoinScreamer’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2025 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
