The electronics retailer said the removal covers its product lineup in all countries and described the decision as a precautionary measure. Ledger said the sales suspension was coordinated with the wallet manufacturer after a customer in Germany reported finding an unauthorized implant.
Ledger said no fund losses have been reported in connection with the German case and that it still has no indication that its infrastructure, systems or services were compromised.
The distinction is important. Ledger has confirmed physical tampering in at least one device connected to the separate CryptoBilis incident in Southeast Asia, but it has not yet confirmed that the devices reported in Germany were compromised through the same supply chain or caused any theft.
What Was Reported in the MediaMarkt Devices?
A customer using the name Johannes said he purchased two Ledger wallets from separate MediaMarkt locations and found similar unauthorized modifications inside both devices, including additional wiring and cellular hardware.
The claims have not yet been independently confirmed by Ledger. One of the devices is being provided to the company for examination.
The European reports matter because MediaMarkt and Saturn have appeared in Ledger’s own authorized-reseller directory for Germany. Until now, Ledger had said every confirmed case in the October 9 wallet-draining incident traced to CryptoBilis, its authorized reseller in Southeast Asia.
That makes the European investigation a test of whether the problem was confined to one reseller or whether compromised hardware entered more than one distribution channel.
Investor Takeaway
The risk has moved from one reseller to the wider distribution chain. Confirmation of a European case would materially broaden the scope of Ledger’s investigation.
How Did the Confirmed Ledger Implant Work?
Ledger provided more technical detail Tuesday on the implant found in a device linked to CryptoBilis.
According to the company’s Donjon security team, the unauthorized hardware monitored information shown on the wallet display during initialization, reconstructed the user’s 24-word recovery phrase and transmitted it externally through an eSIM-based LTE connection.
Ledger said the implant did not modify the Secure Element, alter the operating system or manipulate transactions and signatures. Instead, it attacked a different part of the trust model: the physical path between the secure hardware and what the user sees on the screen.
That distinction also exposes a limitation in Ledger’s Genuine Check. The company’s own documentation says the verification process can authenticate the Secure Element but cannot necessarily detect unauthorized physical additions such as spying implants if the genuine Secure Element remains intact.
How Far Has the CryptoBilis Investigation Reached?
The original investigation began after customers who bought Ledger devices from CryptoBilis reported funds disappearing from their wallets. Ledger subsequently confirmed that one affected device contained an unauthorized hardware implant.
The company has not published an official loss total or victim count. Blockchain analytics firm Bitquery has estimated approximately $93.2 million was taken from 315 wallets across six networks, although Ledger has not adopted that estimate.
Ledger has told CryptoBilis customers not to initialize unused devices and advised customers who already used one to move their assets to a new wallet using a completely new recovery phrase. CryptoBilis stopped hardware-wallet sales while the investigation continues.
Ledger has also reminded distributors to source products only through approved channels and not to return previously sold devices to inventory.
Investor Takeaway
Hardware-wallet security now depends on chain of custody as well as cryptography. An authentic Secure Element cannot protect a recovery phrase captured elsewhere inside a modified device.
What Does MediaMarktSaturn’s Withdrawal Change?
The retailer’s decision effectively creates a temporary quarantine around Ledger inventory while investigators determine whether the German reports are genuine and, if so, where the devices were modified.
The next question is provenance. Investigators need to establish whether the reported European devices came through normal distributor inventory, were customer returns that re-entered circulation, or were altered elsewhere before reaching store shelves.
A separate report has also emerged from former Mt. Gox CEO Mark Karpelès, who said a Ledger Flex purchased at Singapore’s airport contained an implant. Ledger has not publicly confirmed that device as part of the incident and says it is reviewing reports involving other products and locations.
Until those examinations are complete, there is no evidence that Ledger devices generally are compromised or that products bought directly from the manufacturer are affected. But if investigators verify tampered devices from multiple authorized retail channels, the central security question will shift from what happened at CryptoBilis to how altered hardware entered Ledger’s broader distribution network without being detected before reaching customers.