MediaMarkt halts Ledger sales amid tampering probe

TLDR

MediaMarktSaturn has paused all Ledger hardware wallet sales in stores and online while a tampering investigation and a wider Ledger supply-chain probe continue.

1. MediaMarkt removed Ledger products across its network after a German customer and other users reported suspected implants in devices bought at its stores.
2. Ledger has separately confirmed malicious implants in devices sold by reseller CryptoBilis that can capture recovery phrases during setup, with unverified loss estimates above 86 to 100 million dollars.
3. Hardware wallet users should focus on purchase channels, device inspection and recovery-phrase hygiene, and monitor official Ledger and retailer updates for guidance.

Deep Dive

1. Retailer Halt And Scope

MediaMarktSaturn has taken Ledger wallets off shelves and its online platforms across Europe as a precaution after reports of tampered devices bought in its stores, and is coordinating with Ledger on the investigation. Reports include an X user, Johannes, who said two units from separate MediaMarkt locations contained unauthorized cables and cellular modules, and a separate claim by former Mt. Gox CEO Mark Karpels about a Ledger Flex bought at Singapore airport. In the German case that triggered the stop, Ledger says no customer funds were lost and it has no evidence its own infrastructure or services were compromised, but it has not yet confirmed how many devices are affected or whether the MediaMarkt cases link to the Southeast Asian reseller incident, as noted by crypto.news in its coverage of the German suspension.

2. Confirmed Supply-Chain Tampering At CryptoBilis

Separately, Ledgers Donjon security team has confirmed that some devices sold by Southeast Asian reseller CryptoBilis contained unauthorized LTE implants that read the 24?word recovery phrase from the screen during setup and sent it over a provisioned eSIM. The implant uses a microcontroller tapped into the display, without altering the secure chip, operating system or transaction signatures, which means normal authenticity checks may not detect it. Onchain researchers have estimated suspected losses above 86 to around 102 million dollars, but Ledger stresses that totals and victim counts remain unverified and that all confirmed losses so far involve CryptoBilis-sold devices, as summarized by The Block in its report on CryptoBilis implants and the MediaMarkt halt.

3. User Risks And Practical Safeguards

For users, the core risk is that a compromised device can leak the recovery phrase, letting an attacker restore the wallet on another signer and move funds, even though the devices cryptography remains intact. Ledger advises owners of potentially affected CryptoBilis devices not to initialize unused wallets, and to move assets from initialized ones to a new device set up with a completely new recovery phrase. MediaMarkt customers have no confirmed loss cases so far, but if they see signs of tampering they should rely on official Ledger support channels and retailer communications and avoid opening hardware without guidance, since it may be evidence. More broadly, Trezor and OneKey are tightening reseller networks and recommend buying directly from manufacturers or carefully vetted partners, inspecting seals and packaging, and considering multisignature setups across different brands so that one compromised device cannot act alone.

Conclusion

MediaMarkts halt of Ledger sales is a precautionary response to suspected tampering, layered on top of a confirmed but currently localized supply-chain attack via CryptoBilis. While Ledger says its infrastructure and direct sales channels are not implicated, the episode highlights that hardware wallet security now depends as much on trusted distribution and disciplined recovery-phrase practices as on the underlying cryptography, making ongoing official updates and reseller policies important signals for crypto users to watch.