MediaMarktSaturn pulls Ledger hardware wallets amid tampering reports
European electronics retailer MediaMarktSaturn has halted sales of Ledger devices in stores and online following reports that hardware wallets were modified with physical spyware.
European retailer MediaMarktSaturn has removed all Ledger products from its physical stores and online platforms following allegations of tampered devices, according to reports from Cointelegraph and Protos. The German company stated that it is in contact with Ledger and takes the incident very seriously. Ledger officially confirmed the sales pause, stating that it was enacted with its alignment while an investigation proceeds into a report of an implant from a customer in Germany.[1][2][3][4][7]
The withdrawal follows findings shared on social media regarding hardware implants. Independent researcher Johannes reported that two Ledger Nano X wallets bought from different MediaMarkt stores showed identical modifications, including extra cables and hidden cellular LTE modules. Former Mt. Gox CEO Mark Karpelès has also been examining user-dismantled devices, reportedly identifying spyware in wallets sourced from MediaMarkt, Philippine reseller LazMall, Singapore airport reseller Metapod, and Malaysian reseller CryptoBilis. Ledger's security team determined that implants found in CryptoBilis units were designed to intercept a wallet's 24-word recovery phrase and transmit it over an attached eSIM.[4][5]
The European sales halt comes after an $86 million draining incident linked to devices sold by CryptoBilis. However, Ledger stated that it has not verified any wallet draining tied to signers purchased elsewhere and noted that no loss of funds has been reported in the German case. Ledger added that there is no indication its internal infrastructure, systems, or services were compromised, noting that its Donjon cybersecurity team will analyze received devices as the inquiry continues.[4][5][7]
Key facts
- MediaMarktSaturn pulled all Ledger products from its physical stores and online platforms amid reports of tampered devices.
- Ledger confirmed the sales suspension followed a report of a hardware implant from a customer in Germany, with no reported loss of funds.
- Researcher Johannes reported finding identical modifications, including extra wiring and hidden LTE modules, inside two Ledger Nano X devices bought from different MediaMarkt stores.
- Mark Karpelès has reportedly identified spyware in dismantled Ledger units sold by MediaMarkt, CryptoBilis, LazMall, and Metapod.
- Hardware wallets purchased from Malaysian reseller CryptoBilis were drained of roughly $86 million after implants recorded recovery phrases and sent them via eSIM.
- Ledger stated that it has not verified any fund drains tied to devices bought from other retailers and found no evidence that its own infrastructure was breached.
Sources · 7 sources
- BL
BlockNews@blocknewsdotcomPost on X ·
🚨 ALERT: Major European electronics retailer MediaMarkt has reportedly removed all Ledger products from its stores and websites following allegations of tampered hardware wallets. The move follows reports that a hidden cellular module was discovered inside Ledger devices purchased from MediaMarkt.
Open source - CT
Coin TelegraphArticle ·
MediaMarktSaturn pulls Ledger products amid tampering reports European retailer MediaMarkt pulled Ledger products as the wallet maker probes tampering reports beyond CryptoBilis in Southeast Asia.
Open source - TW
The Wolf Of All Streets@scottmelkerPost on X ·
LATEST: MEDIAMARKTSATURN REMOVES ALL LEDGER PRODUCTS FROM STORES AND ONLINE PLATFORMS AMID TAMPERING REPORTS IN CONTACT WITH MANUFACTURER, TAKES INCIDENT "VERY SERIOUSLY"
Open source - PR
ProtosArticle ·
German Ledger reseller pauses sales following $86M draining incident Official European Ledger reseller MediaMarkt is no longer selling the wallets following reports that some of the devices may have been fitted with physical spyware, leading to an $86 million draining incident. The German company told Cointelegraph that it has “removed all of the manufacturer’s products from its stores and online platforms” and that it’s in contact with Ledger. “We take this incident very seriously,” it added. Ledger wallets bought from Malaysian reseller CryptoBilis were drained of millions of dollars worth of funds last week. Since then, former Mt. Gox CEO Mark Karpelès has been helping to identify spyware in Ledger wallets that have been dismantled, photographed, and shared on X by their owners. Karpelès has reportedly found spyware in Ledger wallets sold by MediaMarkt, official Philippine reseller LazMall , CryptoBilis, and more recently, in a wallet sold at Metapod in Singapore’s airport. Ledger hasn’t linked other resellers to $86M drain Despite these discoveries, Ledger’s newest statement only confirmed that wallets sold by CryptoBilis were involved in the draining incident. It said, “We have not verified a drain linked to a signer bought elsewhere,” and adds that it’s “reviewing reports of implants in other signers and locations.” Ledger spyware scare spreads beyond Southeast Asia Read more: Ledger sued for $500M over its many data breaches Ledger also announced that its security team is investigating the tampered devices sourced from CryptoBilis. The team deduced that the spyware was able to record a Ledger wallet’s 24-word recovery phrase and transmit it with the attached eSIM. The company noted that CryptoBilis isn’t selling wallets while the investigation continues. Protos has reached out to LazMall for comment and will update this piece should we hear anything back. Got a tip? Send us an email securely via Protos Leaks . For more informed news and investigations, follow us on X , Bluesky , and Google News , or subscribe to our YouTube channel. The post German Ledger reseller pauses sales following $86M draining incident appeared first on Protos .
Open source - CB
Coin Bureau@coinbureauPost on X ·
🚨BREAKING: MediaMarktSaturn HALTS all Ledger sales in stores and online as reports emerge of hidden spyware in devices bought in Europe. Independent researcher Johannes highlights two Ledger Nano X wallets purchased from different MediaMarkt stores containing identical modifications, including extra cables and hidden LTE modules. MediaMarktSaturn has since suspended Ledger sales as fear spreads over potentially compromised inventory across Europe. The new findings follow the confirmed implants in devices sold by Southeast Asian reseller CryptoBilis that could steal recovery phrases and transmit them over LTE. Suspected losses linked to the previous incident exceed $86 MILLION, while the extent of any impact in Europe remains unconfirmed.
Open source - CO
Cointelegraph@CointelegraphPost on X ·
🚨 JUST IN: MediaMarktSaturn removes all Ledger products from stores and online platforms amid reports of tampered hardware wallets. https://t.co/rB7ZhyXRn1
Open source - DN
DEGEN NEWS@DegenerateNewsPost on X ·
BREAKING: @Ledger CONFIRMS THAT MEDIAMARKT SATURN HAS STOPPED THE SALE OF LEDGER DEVICES IN THEIR STORES AND ONLINE WHILE THE INVESTIGATION CONTINUES, FOLLOWING THE REPORT OF AN IMPLANT FROM ONE CUSTOMER IN GERMANY “NO LOSS OF FUNDS WERE REPORTED” https://t.co/XEpEDy4HOM
Open source