A hardware wallet is only as trustworthy as the box it arrived in. Trezor has started cutting down the list of shops allowed to sell its devices, and one of them has already gone.
According to The Defiant, the reseller CryptoBilis is off the approved seller list, and the wider reduction follows a run of supply-chain incidents involving hardware wallets. Trezor describes the move as preventive and says it has no evidence its own devices were compromised. We have not seen a statement directly from the company, and this is so far carried by a single outlet.
Supply-chain tampering is the attack this guards against. A device is intercepted somewhere between the factory and the buyer, then repackaged so that the inside is one somebody else already knows. The wallet works exactly as advertised. The coins leave within minutes of arriving.
If you are buying a hardware wallet, where you buy it matters as much as which one you buy. Order direct from the manufacturer or an official store rather than a marketplace listing, and treat any device that arrives with a recovery phrase already printed, written or sealed inside as compromised. A genuine wallet generates that phrase itself, in front of you, after you set it up. Our self-custody guide covers the checks, and we compare the two main makers in Trezor vs Ledger.
