MediaMarkt Saturn Halts Ledger Hardware Wallet Sales After German Implant Report

MediaMarkt Saturn pulls Ledger devices

European electronics retailer MediaMarkt Saturn has stopped selling Ledger hardware wallets in every market where it operates, removing the devices from physical stores and its online platforms at once. Ledger confirmed the suspension in an October 13 statement, saying the retailer acted with the company's agreement after a customer in Germany reported finding an implant inside a purchased device. A company spokesperson said Ledger was excluded from all national sale lists as a precaution. The German report came from a user posting as Johannes, who said on October 12 that two Ledger wallets he bought at different MediaMarkt stores each contained an unauthorized cable and a cellular communications module. Ledger stated it has received no report of lost funds in the German case and found no sign that its infrastructure, systems or services were compromised. Its support team is reviewing customer reports, while the Donjon security research team, the firm's in-house unit for testing hardware and software, will inspect the devices submitted during the investigation. Open questions remain: Ledger has not said when sales might resume, how many units could require inspection, which model was affected, or how the modification was performed, and it has not confirmed whether the German case connects to other suspected tampering. The statement also cautioned against unverified claims circulating online and advised anyone worried about a device to contact official support. Ledger repeated that scammers may exploit the situation by asking wallet owners for their 24-word recovery phrases, noting its staff will never call customers or request those words, and said it would publish further information as the inquiry progresses.

@Ledger · X post

October 13 statement.

View on X

The CryptoBilis implant

The German report sits alongside a wider supply-chain inquiry Ledger opened into devices sold through CryptoBilis, a reseller in Southeast Asia. Complaints of missing cryptocurrency from CryptoBilis customers began reaching the company on October 9, and Ledger confirmed the presence of an implant inside an affected device on October 10. Its technical findings, published on October 13, describe how an unauthorized component read the words shown during device setup and sent them out over an LTE cellular connection. The implant paired a separate microcontroller with an eSIM to capture the Ledger recovery key without touching the Secure Element, the operating system or the transaction signatures, so payments were never altered on-device. Blockchain analytics firm Bitquery estimated suspected losses of roughly $102 million across 324 wallets in an October 12 analysis; Ledger has not verified that figure, the number of victims, or whether every suspicious transaction came from a modified device. What the company has confirmed is that every fund loss it checked so far involved devices bought through CryptoBilis, with no confirmed theft involving signers from other channels. Ledger instructed customers holding unopened CryptoBilis devices not to initialize them, and told anyone who already used a possibly affected wallet to move funds to a new device set up with fresh words, warning that restoring an existing phrase protects nothing once the original has leaked. The inquiry now extends beyond CryptoBilis to other sales routes. On October 13, former Mt. Gox chief executive Mark Karpeles said he found a spy device inside a Ledger Flex he bought at Singapore airport; Ledger referred questioners to its CryptoBilis updates instead of addressing the claim directly. Security researchers also identified fake Ledger websites in Google search results on October 11, though Ledger said those phishing campaigns are not connected to either investigation.

Cold storage assumptions under test

What links the two cases is the retail channel, not Ledger's own systems. Neither incident involves a breach of Ledger's infrastructure, yet both show that a cold wallet bought through a third party carries a risk the buyer cannot inspect: the design assumes the private key never leaves the sealed device, and a tampered unit breaks that assumption at the point of sale. The Donjon findings confirmed the CryptoBilis implant worked without altering transaction signatures, so balances appeared normal until funds moved. The joint suspension at MediaMarkt Saturn, agreed before any German loss was confirmed, indicates the company treats retail channel integrity as the unresolved question, and it has committed to publish findings as the inquiry advances.