MediaMarktSaturn pulls Ledger hardware wallets from sale across Europe amid tampering reports

MediaMarktSaturn suspended sales of Ledger hardware wallets across more than 1,000 European stores on October 13, 2026, following reports of tampered devices containing hidden LTE hardware implants designed to steal 24-word recovery phrases. The precautionary pull comes amid investigations into Southeast Asian reseller CryptoBilis, where confirmed implants are linked to unverified losses estimated between $86 million and $102 million. No fund losses have been reported from MediaMarktSaturn units, but competing wallet makers Trezor and OneKey are curtailing reseller authorized networks in response.

MediaMarktSaturn suspends Ledger wallet sales

• ▪MediaMarktSaturn suspended sales of all Ledger hardware wallets across online platforms and over 1,000 physical stores in 11 countries on October 13, 2026, following customer reports of hardware tampering.
• ▪Ledger confirmed that MediaMarktSaturn suspended sales following a single customer implant report in Germany, noting no loss of funds has been linked to MediaMarkt devices.

Security researcher's Findings and recall demand

• ▪Security researcher Johannes called for an immediate product recall and sent the tampered devices for analysis, including one directly to Ledger.
• ▪Security researcher Johannes reported finding unauthorized cables and cellular modules inside two Ledger Nano X devices purchased at separate MediaMarkt stores in Germany.

Aqipa GmbH supply chain role

• ▪Store records identified distributor Aqipa GmbH as the inventory supplier for the Ledger hardware wallets sold at MediaMarkt locations.
• ▪Distributor Aqipa GmbH previously announced a distribution partnership covering retail operations in Germany and Austria.

How the hardware implants operate

• ▪Ledger Donjon stated the hardware implant operates as a separate component without modifying the device's Secure Element, Ledger operating system, or transaction signatures.
• ▪Ledger Donjon reported hardware implants use a microcontroller to decode screen data during setup, capturing 24-word recovery phrases and transmitting them over LTE using a provisioned eSIM.

Tampered Ledger Flex in Singapore

• ▪Former Mt. Gox CEO Mark Karpelès reported finding a spy implant inside a unused Ledger Flex device purchased at a Metapod location in Singapore's Changi Airport.
• ▪Mark Karpelès published teardown images and video showing an implant designed to monitor screen communications and capture recovery phrases during setup.

Ledger response to CryptoBilis compromise

• ▪Ledger asked CryptoBilis to pause all sales and shipments of Ledger signers while cybersecurity teams examine recovered hardware.
• ▪Ledger confirmed that unauthorized hardware implants were present in devices sold by Southeast Asian reseller CryptoBilis following reports of compromised wallets on October 9, 2026.
• ▪Ledger advised CryptoBilis customers to leave unused devices unpowered and promptly transfer assets from activated signers using a newly generated recovery phrase.

Financial losses from CryptoBilis devices

• ▪Third-party on-chain analyses estimate total losses from tampered CryptoBilis Ledger devices range between $86 million and $102 million across Bitcoin, Ethereum, and Tron.
• ▪Ledger stated that all verified fund losses involve signers sold through CryptoBilis, but noted third-party loss estimates remain unverified by the company.

Other manufacturers cut ties with CryptoBilis

• ▪Hardware wallet manufacturer Trezor removed CryptoBilis from its reseller list and announced plans to reduce its broader reseller network effective January 1, 2027.
• ▪Hardware wallet maker OneKey revoked CryptoBilis' reseller authorization and offered free replacement devices for customers who purchased through CryptoBilis between March 1 and October 13, 2026.

Debatable claims

• ▪Ledger bears primary responsibility for supply chain tampering occurring within authorized reseller networks
• ▪Hardware wallet manufacturers should eliminate third-party resellers
• ▪MediaMarktSaturn's European Ledger sales suspension was a prudent response to supply chain risks