Ledger hardware wallets have been withdrawn from sale at MediaMarkt Saturn stores and online following a reported device implant involving a customer in Germany.
Summary
- MediaMarkt Saturn has suspended Ledger hardware wallet sales in physical stores and online with Ledger’s agreement following a reported device implant in Germany.
- Ledger said no customer funds were lost in the reported German case and found no evidence that its infrastructure, systems or services had been compromised.
- Ledger’s Donjon security team will examine devices received during the investigation, while support staff review customer reports.
- The suspension follows separate findings involving modified Ledger devices sold through CryptoBilis, where unauthorized hardware was used to capture wallet recovery phrases.
According to an October 13 statement from Ledger, the retailer stopped selling the devices with the company’s agreement while an investigation into the reported hardware tampering continues. No loss of customer funds has been reported in connection with the case.
The suspension covers both physical retail locations and online sales. Ledger has not provided a date for when sales could resume or disclosed how many devices may require inspection.
The company said it had found no indication that its infrastructure, systems or services were compromised. Its support team is reviewing customer reports, while its Donjon security research team will examine devices received as part of the investigation.
Ledger urged customers with concerns about purchased devices to contact its official support service. It warned that scammers could exploit the incident by contacting wallet owners and requesting their 24-word recovery phrases.
Ledger investigates reported hardware implant in Germany
The reported implant has raised questions about the integrity of hardware wallets sold through third-party retail channels. Ledger’s statement did not identify the affected device model, the store where it was purchased or the method used to modify it.
The company has not confirmed whether the German report is connected to other suspected cases of hardware tampering.
Ledger’s Donjon team specializes in testing the security of hardware and software products. According to the company, the team will examine devices submitted for inspection while support staff review reports from users.
Although the investigation remains open, Ledger cautioned against relying on figures and claims circulating online that have not been independently verified.
The company said it would publish further information as its investigation progresses.
CryptoBilis investigation uncovered recovery phrase theft method
Earlier on October 13, crypto.news reported Ledger’s technical findings concerning modified devices sold by Southeast Asian reseller CryptoBilis.
Ledger’s Donjon researchers confirmed that an unauthorized component inside an affected signer could read recovery phrases displayed during device setup and transmit the information through an LTE cellular connection.
The implant used a separate microcontroller and an eSIM to capture the recovery words without changing the device’s Secure Element, operating system or transaction signatures.
Ledger confirmed the presence of the implant on October 10 after receiving complaints of missing cryptocurrency from CryptoBilis customers beginning October 9.
The reseller subsequently suspended hardware wallet sales while the company investigated the reported losses.
Blockchain analytics firm Bitquery estimated suspected losses of approximately $102 million across 324 wallets in an October 12 analysis. Ledger has not verified the amount, the total number of victims or whether all the suspicious transactions were caused by modified devices.
In its findings published earlier Tuesday, Ledger said every fund loss it had verified in the CryptoBilis investigation involved devices purchased through that reseller. It had not confirmed any theft involving signers bought through other distribution channels.
The company instructed customers who had not initialized CryptoBilis devices to avoid setting them up. Customers who had already used potentially affected wallets were advised to transfer their cryptocurrency to new devices initialized with new recovery phrases.
Ledger warned that restoring an existing recovery phrase on another device would not protect funds if the original phrase had already been exposed.
Ledger warns customers about recovery phrase scams
Separate security warnings have emerged concerning fraudulent websites impersonating Ledger and attempting to collect wallet recovery phrases.
On October 11, researchers identified fake Ledger websites appearing in Google search results, including pages that directed users toward fraudulent wallet applications.
Cybersecurity firm Zscaler had documented a similar phishing operation in September involving malicious Google advertisements. Its researchers found that the fraudulent verification pages collected recovery phrases and transmitted them to an attacker-controlled domain.
The phishing campaigns have not been linked to the CryptoBilis hardware implant investigation or the reported German device.
In its latest statement, Ledger warned customers that its support personnel would never call them, send unsolicited direct messages or ask for their recovery phrases.
Customers were instructed to rely on official Ledger and MediaMarkt Saturn communications for information about the investigation.
Ledger said it would share any future findings as its security team continues examining the reported incidents.
