MediaMarktSaturn Pulls Ledger Wallets in Germany as Implant Probe Expands
MediaMarktSaturn has removed Ledger hardware wallets from its German stores and online platforms as the manufacturer investigates reports of unauthorized components inside the devices. The retailer said it had contacted Ledger and was treating the matter seriously. The decision follows claims from a customer who said two wallets purchased at separate MediaMarkt locations contained additional cables and cellular modules.
The reports have widened a security investigation that began with cryptocurrency losses linked to hardware wallets sold by Southeast Asian reseller CryptoBilis. Ledger confirmed on October 10 that at least one device connected to the incident contained an unauthorized hardware implant. The company later said all confirmed cases involved devices distributed through CryptoBilis, although it was investigating additional reports by October 13.
Potential implants raise concerns because they could interfere with the initial setup process, when a hardware wallet displays a user’s secret recovery phrase. A malicious component could capture that phrase and transmit it over a cellular network, potentially allowing attackers to access the user’s cryptocurrency. However, Ledger has not publicly confirmed that the devices reported in Germany were compromised or linked them to the Southeast Asian investigation.
Security Probe Expands
On-chain analysts estimate that attackers stole between $86 million and $93 million from more than 300 wallets across several blockchains. Ledger has not confirmed a final loss figure. The company maintains that its internal systems and direct sales channels remain unaffected.
Ledger is cooperating with authorities and reviewing its reseller controls and hardware protections. The company has also emphasized the importance of purchasing devices through authorized distribution channels and preventing returned products from reentering inventory.
Ledger advised customers who purchased devices through CryptoBilis not to initialize unused wallets. Customers who already activated potentially affected devices should transfer their funds to a new recovery phrase generated on a device obtained directly from Ledger. The company also warns users never to share their 24-word recovery phrase with anyone claiming to provide customer support.
Supply-Chain Questions
MediaMarktSaturn’s decision represents a precautionary response, not proof that compromised devices circulated widely in Europe. Investigators must still establish the origin of the components reported by customers, determine whether additional devices were affected, and clarify how any unauthorized modifications occurred.
The distinction matters for cryptocurrency investors who rely on hardware wallets to protect their digital assets. While Ledger says its internal systems remain secure, the investigation highlights a separate vulnerability: even security-focused devices may face risks when attackers interfere with the physical supply chain. The German sales suspension adds pressure on the manufacturer and retailer to establish whether the reported incidents represent isolated cases or a broader distribution problem.
