Trezor to reduce number of authorized resellers by January 2027

[Ashawowo(OS)]

Following the Ledger devices tampering, Trezor has made a difficult, yet necessary decision to checkmate the network from which its devices gets to the users and that involves reducing the number of resellers so they can effectively checkmate those they work with, the affected resellers were issued the letter below

https://x.com/Dantoshi/status/2110000117856248141

[Charles-Tim]

Our sales might be reduced with what happened to Ledger.
What are we going to do?
Let us reduce the number of the resellers.
Solved.
Probably this might let people continue to trust us.

How are we sure that the numbers of resellers that remain will be innocent? I think Trezor only trust the resellers. Or am I wrong? What if one of the resellers later break the trust?

[bitmover]

Our sales might be reduced with what happened to Ledger.
What are we going to do?
Let us reduce the number of the resellers.
Solved.
Probably this might let people continue to trust us.

How are we sure that the numbers of resellers that remain will be innocent? I think Trezor only trust the resellers. Or am I wrong? What if one of the resellers later break the trust?

Personally,  I would never buy from a reseller (unless a very trusted one like amazon)
I have bought in my life 2 hardware wallets, the first one in 2017. Both were straight from the manufacturer

I was always afraid to buy a modified or not genuine hardware.

[OmegaStarScream]

-snip-
How are we sure that the numbers of resellers that remain will be innocent? I think Trezor only trust the resellers. Or am I wrong? What if one of the resellers later break the trust?

They said "small enough that we can vet and check every partner that remains"

So from my understanding, the reason why they're scaling down, is to be able to check the resellers which is not doable or sustainable at the current scale.

Obviously though, I highly doubt anyone would continue to buy from anywhere other than the official site at this point.

[mikel_012]

Personally,  I would never buy from a reseller (unless a very trusted one like amazon)
I have bought in my life 2 hardware wallets, the first one in 2017. Both were straight from the manufacturer

I was always afraid to buy a modified or not genuine hardware.

Amazon is not so trusted because you can return the package and the warehouse does not check everything properly

Did you not see cases in Brazil of people buying games or phones and receiving an empty box? Just because amazon is a big company it does not mean they are safe from criminals, and if the hardware wallet can be bought and returned to be reselled you can not trust it definitely

I would only buy from the Trezor store and ask if it is not a returned package to be sure

[rdluffy]

A company’s relationship with third parties is quite complicated
Perhaps in the not so distant future, companies will only sell hardware themselves, without any other authorized parties or third parties to guarantee authenticity

After entropy, this is yet another area where hardware wallet companies need to evolve, along with data handling

There are some things we only truly appreciate after a massive screw-up like the latest one from Ledger
Or maybe the future will be without hardware wallets, just software, and everyone will use their own device (smartphone, PC, laptop, etc.)

[m2017]

This should comfort you. On the other hand, Trezor is launching a new direction in security: https://x.com/Trezor/status/2108162095904616738

The main thing is to avoid a leak of the seed-phrase; otherwise, you’ll have no end of trouble.

Our sales might be reduced with what happened to Ledger.
What are we going to do?
Let us reduce the number of the resellers.
Solved.
Probably this might let people continue to trust us.

However, reducing the number of resellers will also cut sales (the sales market). Many people bought HW-devices from resellers because it was quick and convenient. Many users would likely prefer to buy a hardware wallet from a different brand (locally) rather than wait for delivery from Trezor.

Therefore, your assertion is debatable.

How are we sure that the numbers of resellers that remain will be innocent? I think Trezor only trust the resellers. Or am I wrong? What if one of the resellers later break the trust?

Users trust Trezor, Trezor trusts resellers... the whole chain relies entirely on trust.

There are no guarantees. A reseller might be reliable today, but not tomorrow. Need to implement mechanisms that completely eliminate the possibility of resellers "tampering" with HW-devices or else do away with the reseller middleman entirely.

By the way, unofficial resellers (I’ve seen HW-devices sold in electronics stores and on online marketplaces, for instance) aren't stopping their operations, and there will likely still be users who buy from them (not everyone follows the news or is tech-savvy enough to understand the associated risks).

[SFR10]

Following the Ledger devices tampering, Trezor has made a difficult, yet necessary decision to checkmate the network from which its devices gets to the users and that involves reducing the number of resellers so they can effectively checkmate those they work with,

I have mixed feelings about it... I get why they have to do it, but at the same time, there's going to be more unofficial resellers, or rather scalpers in the future and I'm pretty sure most of them won't go the extra mile to make sure there aren't any issues with the supply chain ^{[to rub salt in the wound, Trezor doesn't ship to all countries and nothing stops a newcomer from choosing the unofficial routes in such countries]}!
^{- Reducing the attack surface (on one side) isn't going to solve the issue in question.}

[Hyphen(-)]

A company’s relationship with third parties is quite complicated
Perhaps in the not so distant future, companies will only sell hardware themselves, without any other authorized parties or third parties to guarantee authenticity

Usually, anything involving a third party can be complicated, and hardware wallets have reputation already that need to be protected, they have been there for long and their devices has been so good to hold our Bitcoin, but starting have have problem not from them but the suppliers, I think it’s time they consider taking action which should involve finding way to sell it out themselves, because no matter how you can trust a third party, anything can happen, and it will stain their reputation.

After entropy, this is yet another area where hardware wallet companies need to evolve, along with data handling

There are some things we only truly appreciate after a massive screw-up like the latest one from Ledger
Or maybe the future will be without hardware wallets, just software, and everyone will use their own device (smartphone, PC, laptop, etc.)

Time will come when people will prefer to use the software open source wallets in their PCs than buying a hardware wallet that can be compromised either from the supplier or somewhere else. They need to handle data properly and find means of sending their product directly to customers.

[Forsyth Jones]

What was the criterion Trezor used to decide which resellers will be discarted from their scope? Was it the number of suspicious incidents, issues with customer support or some other parameter?

Besides, resellers help buyers purchase process much more convenient, for buyers in South America, purchasing directly from the manufacturer is far from easy, not to mention the complications regarding customs duties and taxes.

Of course, buying directly from the manufacturer is always the best option to minimize the risk of a supply chain attack, but unfortunately, importing is difficult, some countries charge import duties of up to 60%, which is absurdly high. If there were tax incentives for certain electronics, such as lower taxes on hardware wallets, buyers would have a greater incentive to purchase directly from the manufacturer, regardless of the continent...

[AakZaki]

Personally,  I would never buy from a reseller (unless a very trusted one like amazon)
I have bought in my life 2 hardware wallets, the first one in 2017. Both were straight from the manufacturer

I was always afraid to buy a modified or not genuine hardware.

I'm sure after the recent events that happened to Ledger, many people will become paranoid about buying any wallet from a third party.

Regarding buying on Amazon, can you be sure that it is genuine from a company like Trezor directly? I myself have never bought via Amazon, because I think Amazon is like a Marketplace where the seller is another party (not from the wallet company itself).

Around 2017, I only bought once from the Trezor website, namely Trezor One and until now it has been used without any problems.

[Zaguru12]

Personally,  I would never buy from a reseller (unless a very trusted one like amazon)
I have bought in my life 2 hardware wallets, the first one in 2017. Both were straight from the manufacturer

I was always afraid to buy a modified or not genuine hardware.

The thing is if a reseller is listed under the company’s list of resellers should we now call this resellers third party resellers. Personally I feel like with authorization of the company and even have them on site as official resellers it’s simply like this is our store and this is what most people might have looked into. I still don’t want to put this ledger loss on victims buying from resellers most would have bought because of the company’s authorization.



Last I check CryptoBillis hasn’t been removed on the ledger site as an authorized reseller, that explains to you this ledger team how they are not even proactive

[Ashawowo(OS)]

Following the Ledger devices tampering, Trezor has made a difficult, yet necessary decision to checkmate the network from which its devices gets to the users and that involves reducing the number of resellers so they can effectively checkmate those they work with,

I have mixed feelings about it... I get why they have to do it, but at the same time, there's going to be more unofficial resellers, or rather scalpers in the future and I'm pretty sure most of them won't go the extra mile to make sure there aren't any issues with the supply chain ^{[to rub salt in the wound, Trezor doesn't ship to all countries and nothing stops a newcomer from choosing the unofficial routes in such countries]}!
^{- Reducing the attack surface (on one side) isn't going to solve the issue in question.}

Trezor and even ledger has been warning over the years that purchases should only be made through authorized resellers, but some people prefer to prioritize lower hanging fruits from  fake vendors advertising even on social media, it's their fault if they received tampered devices from unauthorized resellers and Trezor isn't responsible for their loss..

I've read consistent reports that Trezor devices ( Trezor one and Model T) were found compromised as well, but when I dug into the story, it was an obvious case of buying from unauthorized resellers _{this is why Trezor maintains with their full chest that none of its devices were compromised}, there's no record of funds loss as well . FUD promoters like  DelCrxpto has tried to shill fake news all over X today without success.

[Meuserna]

This is a good move on Trezor's part.

I said this in one of the other threads, but it's worth repeating. We're in a new era for Bitcoin self custody. Scammers, hackers and thieves are getting smarter, and we all have to get smarter too.

Years ago, I thought it was smart to buy hardware wallets on Amazon as part of a larger order, so everything got sent together. I'm convinced this helped me stay out of Ledger's customer data leak. But these days, I don't even think that's wise.

When Ledger added a key extraction API to their firmware, I switched to DIY hardware wallets. SeedSigner and Krux. I'm so glad I did. The ShieldSigner fork of SeedSigner is superb. It's basically SeedSigner with encrypted Seed QR, passphrase QR, and smartcard capability (my favorite of which is Seedkeeper, which is free and runs on ShieldSigner. All open source).

I still have nothing but respect for Trezor, but I'm a DIY guy now, 100%.

[X-ray]

About time they should stop these authorized reseller channel for distribution and use their own distribution channel as the only way to distribute their hardware wallet.

I don't understand why they operates like an indiegogo kickstarted project but what I hate the most about this kind of thing is how there's nothing the hardware wallet maker can do about it and we're left hanging over the security of recently bought hardware wallet, either we open it up and dissect it or we would never know.

Got trezor wallet and still don't know what to do about it and the crypto i have inside it.

[stompix]

I have a better solution! Bring back physical shops!

Trezor will open a physical shop in Prague, move their entire assembly line here, you book an appointment, you fly there, you watch live as your Trezor gets assembled, you get it with no way of someone being able to add anything to it, you pay and you're on your 36-hour flight back home safe and fulfilled!

After all, security has no price, or something like that, right?   

[Meuserna]

I have a better solution! Bring back physical shops!

That has its risks too. How do you know if an unscrupulous employee might have tampered with devices? And any would-be thief who sees you buying something at that shop knows you're a mark (assuming it's strictly a hardware wallet shop or Bitcoin merch shop).

This is why I've become such a big believer in the DIY Bitcoin self custody movement. SeedSigner and ShieldSigner run on a plain old Raspberry Pi Zero. It isn't feasible for a thief to tamper with Raspberry Pis in hopes of getting a Bitcoin wallet since they'd have to tamper with millions of Pis just in hopes of finding one or two wallets. And even then, it wouldn't work since the Pi doesn't store the seed (it's stateless).

That's the kind of solution I switched to a few years ago, and my experience doing Bitcoin this way has been fantastic. It's not for everyone, of course. DIY really does mean do it yourself, though there's an amazing DIY community to learn from. I'm surprised I don't see more DIY folks here on Bitcointalk.

[ABCbits]

Personally,  I would never buy from a reseller (unless a very trusted one like amazon)
I have bought in my life 2 hardware wallets, the first one in 2017. Both were straight from the manufacturer

I was always afraid to buy a modified or not genuine hardware.

Amazon is not so trusted because you can return the package and the warehouse does not check everything properly

Did you not see cases in Brazil of people buying games or phones and receiving an empty box? Just because amazon is a big company it does not mean they are safe from criminals, and if the hardware wallet can be bought and returned to be reselled you can not trust it definitely

I would only buy from the Trezor store and ask if it is not a returned package to be sure

Such issue also happen on other country with different goods. For example, https://www.techspot.com/news/113694-amazon-seller-sends-1400-rtx-5080-customer-cheap.html shows a buyer get a mug with fake instruction/message, when he supposed to receives computer GPU. It's worse than not checking properly.

I have a better solution! Bring back physical shops!
--snip--

But IMO people who choose to buy from authorized reseller rather than official online shop unlikely to buy from official physical shop.