The shelf stays authorized. Trezor will not ship new devices to the partners it is cutting. Those partners can keep selling the stock they already have through Black Friday, and the authorization ends on January 1.
On October 13, @Dantoshi posted the letter as a photo. The post is https://x.com/Dantoshi/status/2110000117856248141. When I read it this morning it had 3,084 likes, 206 reposts, and 439,264 impressions. About two minutes later @Trezor posted the short version. https://x.com/Trezor/status/2110000774314873020. 2,585 likes, 276 reposts, 146,775 impressions. That afternoon @BitcoinNewsCom put the letter in caps. https://x.com/BitcoinNewsCom/status/2110014449448783969. 447 likes, 63 reposts, 37,746 impressions. The caps post says the cut follows the Ledger supply-chain attack. The letter does not name Ledger.
The path and the holiday
Danny Sanders signed the letter as chief commercial officer. I read the image on his post.
The letter says a recent supply-chain attack on another hardware wallet brand confirmed what they have always known. “A hardware wallet is only as safe as the path it travels to reach its owner, and every device that passes through hands we cannot properly check puts someone’s savings at risk.” The decision in that paragraph is to make the reseller network “much smaller, small enough that we can vet and check every partner that remains.”
The next paragraph is in bold. “Let me be very clear: there is not a single piece of evidence that Trezor devices have been compromised. This is a preventive step, taken out of an abundance of caution.” The @Trezor post uses those two sentences with “us” instead of “me,” and adds a thank-you for the years of work putting Trezor in people’s hands. It does not include a date.
The date is in the letter. “If you are receiving this letter, your authorization ends on 1 January 2027. On that date we will remove you from our list of authorized Trezor resellers.” The letter says this is not a verdict on the business, or on the safety of the devices they sell. It is about how many partners Trezor can check closely.
“We will not ship new stock to you after today, but we want the transition to be as fair as we can make it, so until 1 January you can keep selling your remaining stock through the full Black Friday and holiday season, the strongest weeks of the year.”
October 13 to January 1 is 80 days. Black Friday 2026 is November 27, 45 days from October 13. New stock stops on the day of the letter. The stock already in those shops does not. The letter dates the removal for January 1, not for October 13. Until then the name stays on the authorized list.
The letter says they looked at every country on its own, weighing revenue and distribution against Trezor’s own presence, “to find the best way for people to buy a genuine Trezor easily.” It does not say how many partners got the letter. It does not say how many devices are already on those shelves. I do not have either number.
A later paragraph is about the partners who stay. “Supply-chain security is never finished, so we are raising the bar for every partner who continues with Trezor, with an updated legal framework and closer checks on how devices are sourced, stored and handled.” That sentence is for the partners who continue. The shops receiving the letter are the ones being removed. They can still sell what they have until January 1. The letter does not say those closer checks apply to that sell-down.
The other shelf came off
The same day, Ledger posted that a retailer had taken devices off the shelf. https://x.com/Ledger/status/2109984923343782374. When I read it, 543 likes, 101 reposts, 180,716 impressions. As of October 13, MediaMarkt Saturn stopped selling Ledger devices in its stores and online, “with Ledger’s alignment,” while the investigation continues. The post says the stop follows a report of an implant from one customer in Germany. No loss of funds was reported. Ledger says it has no indication that its infrastructure, systems, or services were compromised. It also says many claims and figures circulating online are unverified.
The implant description is in the Donjon update from earlier that day. https://x.com/Ledger/status/2109896739985453358. 1,483 likes, 247 reposts, 487,789 impressions. Ledger confirmed an unauthorized hardware implant on October 10, in one affected user’s signer sold by CryptoBilis, a reseller in Southeast Asia. All confirmed fund losses tied to the October 9 disclosure involve signers sold through CryptoBilis. Ledger has not verified a drain linked to a signer bought elsewhere. The implant sits inside the enclosure and reads the data shown on the screen. During setup the signer displays the 24-word recovery phrase. When the implant detects those screens, it decodes the words and transmits them over LTE using an eSIM. It does not modify the secure element or the operating system. Ledger has not confirmed how many users were affected, or the value lost. Figures online are not Ledger’s number. I am not using them.
I wrote on Monday that Genuine Check does not see that implant if the secure element is still the real one. The check looks at the chip. The 24 words still have to cross to the screen once, during setup.
MediaMarkt took Ledger devices off the counter after one reported implant in Germany, with no reported loss of funds. Trezor’s letter says there is not a single piece of evidence its own devices have been compromised. The same letter leaves the remaining stock authorized through the weeks it calls the strongest of the year. It also says the cut is not a verdict on the safety of the devices those shops sell. The path sentence and the holiday sentence are both in the photo Sanders posted. The partners the letter says it cannot check closely enough can still sell the boxes they already have, until January 1.
I read the letter image and the two Ledger posts. I did not see a count of the stock still on those shelves. The authorization on that stock runs to January 1.