MediaMarkt halts Ledger sales after German customer reports hardware implant

European electronics retailer MediaMarktSaturn has stopped selling hardware wallets made by Ledger in its stores and online. In a post on X at 9:29 p.m. KST on Oct. 13, Ledger said a customer in Germany had reported finding an unauthorized component, or implant, inside a device, and that MediaMarktSaturn had halted sales in coordination with Ledger while the investigation continues. "No loss of funds were reported," Ledger said of that case.

Every theft Ledger has confirmed so far involved devices sold by CryptoBilis, a reseller in Southeast Asia. With a major European retail chain now pausing sales, the investigation now covers reports from outside Southeast Asia.

Two devices from two European stores, same modification

The European reports began a day earlier. X user Johannes (@0xJohannes_) claimed at 10:17 p.m. KST on Oct. 12 that Ledger devices he bought at two different MediaMarkt stores both contained extra cables and an LTE module. He said he recorded the unboxing of the second device and that a store employee told him it was not a returned unit. Store records showed the inventory came through German distributor Aqipa, according to him.

"The products have been removed from our product lineup internationally in all of our countries. We did this as a precautionary measure," a MediaMarktSaturn spokesperson told Cointelegraph. Ledger has not said whether the European reports are linked to the CryptoBilis case, and it has not verified Johannes' claims.

Recovery phrase sent out over a cellular network

At 3:39 p.m. KST on Oct. 13, Ledger published the first findings from Donjon, its in-house security research team. The implant sits inside the device enclosure and reads the data shown on the screen. During setup, a Ledger device displays the 24-word recovery phrase used to restore a wallet. When the implant's microcontroller detects those screens, it decodes the words and transmits them over LTE using a provisioned eSIM.

Ledger said the implant is a separate component. "It does not modify the Secure Element or the Ledger operating system, and it does not alter transactions or signatures," the company said. Because anyone holding the recovery phrase can restore the wallet on another device and move the funds, assets are exposed even when the device's own security chip is intact.

1. Oct. 9, 22:32Ledger first says it is investigating fund losses tied to devices sold by CryptoBilis
2. Oct. 11, 02:09Ledger confirms an unauthorized implant in one victim's device
3. Oct. 12, 22:17Johannes says he found implants in two devices bought at MediaMarkt
4. Oct. 13, 15:39Ledger's Donjon explains how the implant works
5. Oct. 13, 21:29MediaMarktSaturn sales halt announced

All times are KST. Ledger said it has not confirmed the total number of affected users or the total value lost, and that figures circulating online come from third parties. Onchain investigator Specter traced more than $86 million in suspected thefts across Ethereum, Tron and Bitcoin, according to Decrypt.

Singapore airport report; Trezor drops the reseller

Reports have also come from elsewhere. Former Mt. Gox CEO Mark Karpelès wrote on X at around 5 p.m. KST on Oct. 13 that he had confirmed a spy implant in a Ledger Flex sold at Singapore's airport. Ledger has not separately confirmed that case, but said it is reviewing reports of implants in other devices and locations. Ledger CEO Pascal Gauthier said the company is reviewing the controls that apply to its direct sales and to resellers, according to CoinDesk.

Competitors have also moved. Trezor said on Oct. 12 that it had no reports of tampered Trezor devices sold by CryptoBilis, but removed CryptoBilis from its reseller list as a precaution. CryptoBilis has stopped sales and shipments of all hardware wallet brands in Malaysia, the Philippines and Indonesia.