Europe retailer halts Ledger hardware wallet sales

TLDR

European electronics giant MediaMarktSaturn has temporarily stopped selling Ledger hardware wallets across its stores and websites after reports of tampered devices.

1. MediaMarktSaturn has removed Ledger products from all its European outlets and online channels as a precaution, in coordination with Ledger, following a German implant report.
2. The move comes amid Ledgers wider investigation into a hardware implant found in devices sold by reseller CryptoBilis in Southeast Asia, linked to large but still unconfirmed crypto thefts.
3. For users, the main risk is compromised devices from third-party resellers rather than Ledgers core software, so purchase channels and recovery phrase hygiene now matter more than ever.

Confidence: high, with some uncertainty around the exact loss totals.

Deep Dive

1. Retailer Suspension Details

MediaMarktSaturn, parent of the MediaMarkt electronics chain, has removed Ledger products from its physical stores and online platforms in all of its countries as a precaution, according to a public statement quoted by Cointelegraph and CoinsKid community coverage removed Ledger products from its physical stores and online platforms.

Ledger says the pause was agreed jointly after a customer in Germany reported a hardware implant inside a Ledger device. The company has reported no fund losses in that specific German case and says it has no indication that its infrastructure, systems or direct sales channels were compromised.

MediaMarktSaturn has not yet given a timeline for resuming Ledger sales or disclosed how many devices may need inspection, keeping the suspension broad across both in-store and online channels.

2. Ledger Implant Incident

Separately, Ledger is investigating a serious supply-chain attack involving devices sold by Southeast Asian reseller CryptoBilis. Its Donjon security team found an unauthorized hardware implant that reads the 24-word recovery phrase from the screen during setup and transmits it over LTE using an embedded eSIM unauthorized hardware implant in a cryptocurrency signer.

All confirmed losses so far involve CryptoBilis-sold devices, with independent on-chain estimates suggesting suspected thefts in the tens of millions of dollars, roughly in the 80 to 100 million range, though Ledger has not verified a total. The company stresses that the implant does not alter its Secure Element or operating system and that it has not verified a drain linked to a signer bought elsewhere.

Ledger has asked resellers in several Southeast Asian countries and Hong Kong to suspend sales and pull hardware from shelves while it determines where in the distribution chain the tampering occurred asked resellers to suspend sales.

3. Safety Steps And Signals

For users, the key risk highlighted here is physical modification of devices in transit or at third-party retail, not a cryptographic failure of Ledgers design. That makes the purchase path and handling of recovery phrases critical.

Best practices include favoring direct purchases from the manufacturer or verified authorized resellers, inspecting packaging and seals, and never sharing or typing a recovery phrase anywhere except on a trusted device. Ledger has also warned that scammers may exploit the news by impersonating support and asking for seed phrases.

Competitors like Trezor are tightening their own reseller networks as a preventive measure, even though they report no evidence of similar tampering on their devices Trezor will reduce its number of resellers. Watching future updates from Ledger, MediaMarktSaturn, and major hardware wallet brands will be important for understanding how supply-chain controls evolve.

Conclusion

MediaMarktSaturns halt of Ledger sales is a precautionary response to a specific implant report that coincides with a broader supply-chain scandal centered on CryptoBilis-sold devices. The technical evidence points to a sophisticated physical modification that steals recovery phrases without breaking Ledgers core security model. For crypto users, the practical takeaway is to focus on trusted purchase channels and strict recovery phrase hygiene while monitoring ongoing investigations and retailer policy changes.