European electronics retailer MediaMarktSaturn has removed Ledger hardware wallet products from its stores and online platforms while the manufacturer continues investigating reports of physical tampering.
In an email, originally shared with Cointelegraph, a spokesperson for the MediaMarktSaturn Retail Group said that the company had taken the products off shelves and was in contact with the manufacturer, adding that it takes the incident “very seriously.”
The decision follows claims by a user who said he purchased two Ledger devices from separate MediaMarkt locations and found unauthorized modifications in both. The broader investigation began after users who bought devices from Southeast Asian reseller CryptoBilis reported losses.
Ledger has confirmed an unauthorized hardware implant in at least one affected device linked to that channel and stated that all verified fund losses from the October 9 incident involve signers sold through CryptoBilis. The company has said it has not verified a drain linked to a device purchased elsewhere, while noting it is reviewing additional reports.
European Reports and Retailer Response
Security researcher Johannes, posting as @0xJohannes_ on X, reported finding extra cables and an LTE module in Ledger Nano X devices bought in person from MediaMarkt stores in Europe. In an October 12 update, he said he recorded the unboxing of a second device purchased the same day from a different location and observed identical modifications. He stated that a store employee told him the unit was not a returned item, noting that returned Ledger products are sent back to the manufacturer rather than resold.
Store records, according to Johannes, identified Aqipa GmbH as the inventory supplier. He called for an immediate product recall and said he was sending the devices for analysis, including one to Ledger.
MediaMarkt operates as an authorized reseller for Ledger in markets including Germany. Aqipa has previously announced a distribution partnership covering Germany and Austria. Ledger has not publicly confirmed that the European devices contain the same implant described in its CryptoBilis analysis or that any verified losses are linked to them. In its latest update, the company directed users who did not purchase from CryptoBilis and wish to inspect their devices to an official guide, while cautioning that opening a signer can damage it and that the recovery phrase should be backed up first.
The retailer’s reported removal of products comes as questions about distribution channels have grown. Ledger confirmed an unauthorized implant after researchers traced substantial suspected thefts from wallets linked to CryptoBilis purchases. On-chain estimates of total losses have varied, with some analyses placing figures above $86 million and others higher; Ledger has not confirmed a total and has described the volume of impacted devices as limited.
Technical Details from Ledger’s Investigation
Ledger Donjon, the company’s security research team, described the implant found in a CryptoBilis-linked device in an October 13 update. The component sits inside the enclosure and reads data shown on the screen.
During setup, when the signer displays the 24-word recovery phrase, the implant’s microcontroller decodes the words and transmits them over LTE using a provisioned eSIM. Ledger stated that the implant is a separate component that does not modify the Secure Element or the Ledger operating system and does not alter transactions or signatures.
The company confirmed the presence of the implant on October 10 in one affected user’s device. CryptoBilis has stopped selling Ledger signers while the investigation continues. Ledger has advised users who bought from CryptoBilis not to set up unused devices and, if already set up, to transfer assets promptly to a new signer with a newly generated recovery phrase. It has also said it is working with authorities, contacting affected users, and reviewing reports of implants in other signers and locations. Figures circulating online for total losses come from third parties and have not been fully verified by Ledger.
Users who purchased devices outside the confirmed CryptoBilis channel are directed to Ledger Support for questions, and the company has reiterated that it will never ask for a recovery phrase via call, message, or form.
Additional Findings and Ongoing Questions
Separately, former Mt. Gox CEO Mark Karpelès reported examining a Ledger Flex purchased at a Metapod location in Singapore’s Changi Airport. He stated that the device, bought by a user this summer and never powered on after the buyer noticed scratches on the casing, contained a spy implant of a newer design hidden in the lower portion, with additional circuitry and wiring.
Karpelès shared images and video of the teardown, describing the component as capable of monitoring screen-related communications to capture a recovery phrase during setup. Ledger has not directly addressed this specific case in its public updates focused on the CryptoBilis investigation.
The combination of confirmed tampering in one channel, user-reported findings at a major European retailer, and the Singapore airport example has heightened scrutiny of hardware wallet distribution.
MediaMarktSaturn’s reported action removes the products from one of Europe’s largest electronics retail networks while contact with the manufacturer continues. Ledger has emphasized that its own systems and direct sales channels remain unaffected in the confirmed cases and that it is examining devices it receives as the probe advances.
Users concerned about devices purchased through any physical retailer are advised to review Ledger’s official guidance and contact support before taking further steps. The investigation remains active, with the company stating it will share additional verified information as it becomes available.
Update (1:05 AM UTC)
Ledger officially confirmed that devices sold by the Southeast Asian reseller CryptoBilis contained an unauthorized hardware implant that reads the 24-word recovery phrase displayed during setup and transmits it over LTE via an embedded eSIM, without modifying the Secure Element or Ledger OS.
The company further stated that MediaMarkt Saturn has stopped selling Ledger devices following a report of a similar implant from one customer in Germany, with no associated fund losses reported and no indication that Ledger’s infrastructure or systems were compromised.
Also read: ZachXBT Slams $250K Bounty for XRP Ledger Bug That Could Have Minted 18 Trillion XRP
