Ledger implant prompts European retailer sales halt

TLDR

Ledger is investigating a hardware implant in some wallets, prompting European retailer MediaMarktSaturn to halt Ledger sales while supply-chain security is reviewed.

1. MediaMarktSaturn has removed Ledger hardware wallets from all stores and online after suspected implants in German-bought devices, in coordination with Ledger.
2. The confirmed thefts so far involve tampered devices sold via Southeast Asian reseller CryptoBilis, with unverified loss estimates in the tens of millions of dollars.
3. For hardware-wallet users, the main risk is supply-chain tampering and phishing, not Ledgers core cryptography, so buying channels and recovery-phrase handling matter more than ever.

Deep Dive

1. Implant And Sales Halt

Ledgers security team confirmed that some devices sold through reseller CryptoBilis contained a hidden hardware implant that reads the screen during setup, captures the 24-word recovery phrase, and sends it over LTE via an eSIM, while leaving the Secure Element and firmware untouched, so the wallet appears genuine to normal checks.

Following separate reports from a customer in Germany and an X user who found unauthorized cables and cellular modules in two devices, MediaMarktSaturn has suspended all Ledger sales in its European stores and online as a precaution, in agreement with Ledger, with no fund losses confirmed from those European cases so far.

Ledger says its own infrastructure and direct sales channels show no signs of compromise and is examining submitted devices while MediaMarktSaturn works with the company to determine how many products need review and whether more units were modified before sale.

2. Scope And Impact

Ledger states that all confirmed wallet-draining cases disclosed to date involve devices sold through CryptoBilis in Southeast Asia, and has ordered distributors across markets such as Indonesia, Malaysia, Singapore and Hong Kong to halt sales and recall units for inspection.

Independent blockchain investigators have estimated suspected thefts in a range from roughly 86 million dollars to about 93 million dollars, but Ledger stresses that these figures and the number of affected users remain unverified and third-party only.

Other hardware-wallet brands, including Trezor and OneKey, report no evidence that their own devices were compromised, yet have cut ties with CryptoBilis and tightened reseller networks, highlighting that trust now hinges on the entire distribution chain, not just the manufacturer.

3. User Security Actions

Ledger advises customers who bought devices from CryptoBilis and have not initialized them to avoid setup and contact support, and those who did initialize to move funds to a new device with a completely new recovery phrase instead of reusing exposed words.

For buyers in Europe or elsewhere, the practical safeguards are to purchase directly from trusted channels, inspect packaging and hardware for obvious tampering where possible, and never use a wallet that arrives with a prefilled recovery phrase or additional spy cables or modules.

Ledger also warns that scammers are exploiting the incident with phishing emails, fake websites and even physical letters; its staff will not call you or ask for your 24-word phrase, so any such request is a red flag.

Conclusion

The Ledger implant scandal shows that hardware-wallet cryptography can stay intact while a supply-chain attacker quietly steals recovery phrases at setup, shifting the main risk to how and where devices are sourced.

MediaMarktSaturns sales halt and Ledgers recalls in Asia are early attempts to contain that risk, but for everyday users the durable protection is strict control over purchasing channels and recovery-phrase hygiene while watching for further investigation updates and any expanded recall or replacement programs.