TLDR
Ledger hardware wallets sold via resellers have been found with spy implants, leading Europes MediaMarktSaturn to pause Ledger sales while investigations continue.
- Ledger confirmed a hardware implant in devices from Southeast Asian reseller CryptoBilis, and MediaMarktSaturn has frozen Ledger sales across Europe pending checks.
- The implant captures the 24-word recovery phrase, so theft risk comes from supply-chain tampering rather than Ledgers core chips or software; the true loss size is still unverified.
- Hardware wallet users should review where they bought their devices, follow manufacturer advisories, and watch for tighter reseller rules across the industry.
Deep Dive
1. What Happened To Ledger Devices
Ledgers security team has confirmed that some signers sold by reseller CryptoBilis contained a hidden hardware implant that reads the screen during setup, captures the 24-word recovery phrase, and sends it over LTE via an embedded eSIM. The extra board is separate from Ledgers Secure Element and operating system, so normal firmware checks do not see it.
Following a separate report from a customer in Germany, major European electronics chain MediaMarktSaturn has halted Ledger sales in stores and online while devices are inspected, with Ledgers agreement. Ledger says no funds have been lost in the German case and that its internal infrastructure and direct sales channels show no signs of compromise.
The confirmed attack is on specific tampered units in reseller channels, not on Ledgers cryptography, but it is serious because it directly exposes recovery phrases.
2. Supply-Chain Risk And Impact
Onchain researchers estimate suspected thefts above $86 million, but Ledger stresses that these loss figures and victim counts remain unverified. All confirmed draining cases so far involve devices bought via CryptoBilis, not direct-from-Ledger or other resellers.
This has turned attention to hardware wallet supply chains. Trezor and OneKey have both revoked CryptoBilis as a reseller and are tightening their wider networks, with Trezor planning to cut some resellers and add stricter inspections. Allegations of additional implants in Europe and Singapore exist, but many are still awaiting manufacturer confirmation.
The main structural risk is physical tampering somewhere between the factory and the store shelf, so brand, channel, and handling of inventory matter as much as device design.
3. What Users Should Watch Next
Ledgers Donjon team is examining submitted devices from CryptoBilis and MediaMarktSaturn, while support teams review user reports. Key future signals include:
- How many units and which batches are formally confirmed as compromised.
- Whether MediaMarktSaturn and other European distributors resume Ledger sales or change their stocking policies.
- How aggressively hardware wallet makers move toward direct sales and smaller, audited reseller networks.
For users, a common approach is to prefer buying hardware wallets directly from the manufacturer or clearly vetted channels, be wary of sealed-but-odd-looking packaging or extra modules, and never share or type a recovery phrase into any support channel or website.
Confidence: moderate because investigations are ongoing and some claims about European scope and loss totals remain unverified.
Conclusion
The Ledger implant scandal shows that even well-designed hardware wallets depend on secure physical distribution, not just strong cryptography. MediaMarktSaturns Europe-wide sales halt is a precaution that highlights rising awareness of supply-chain attacks. Until investigations conclude and reseller policies tighten, the most important safeguards for crypto users are careful choice of purchase channel and strict protection of recovery phrases.
CoinsKid.Com