Ledger Responds to Retail Suspensions

Ledger confirmed on October 13 that MediaMarktSaturn, the parent of the European retailer MediaMarkt, had stopped sales of its hardware wallets in physical stores and online outlets. The company did so with Ledger’s agreement after reports of tampered devices. The move covers both retail locations and e-commerce platforms.

The suspension follows the discovery of an unauthorized hardware implant in at least one wallet sold through Southeast Asian reseller CryptoBilis. Ledger’s Donjon security research team is now examining devices submitted for review, while support staff handle customer reports. The firm stated it found no evidence that its infrastructure, systems or services had been compromised.

Details of the German Report

A customer who purchased two Ledger wallets from separate MediaMarkt stores in Germany claimed the devices contained unauthorized cables and cellular modules. The firm described the incident as a tampering report rather than confirmed theft. Ledger emphasized that no funds had been lost in connection with the German case and that it had not been linked to other distribution channels.

The company instructed all users with concerns to contact official Ledger support. It also warned that scammers could exploit the situation by contacting wallet owners and asking for recovery phrases. Ledger stressed that its support personnel would never call or message customers directly to request such information.

Earlier CryptoBilis Investigation

The current European situation stems from earlier findings involving CryptoBilis. Ledger confirmed in mid-October that modified devices sold through the reseller contained an unauthorized component that could read recovery phrases during device setup and transmit them over a cellular network using an eSIM. The implant bypassed the Secure Element and did not affect transaction signatures or the operating system.

Reports of losses began circulating on October 9 after complaints from CryptoBilis customers. The reseller paused sales pending investigation. Ledger verified that every confirmed fund loss in the CryptoBilis case involved devices purchased through that channel. Blockchain analytics firm Bitquery estimated suspected losses of approximately $102 million across 324 wallets, though Ledger has not independently verified the total or the full scope of affected users.

Customer Guidance and Broader Warnings

Ledger advised anyone who had not yet initialized a device bought from CryptoBilis to avoid doing so. For users who already set up such wallets, it recommended transferring funds to a new device initialized with fresh recovery phrases. Restoring an exposed recovery phrase on another device would not protect the assets.

Separately, Ledger warned about phishing attempts impersonating the company. Fake websites identified in search results and malicious Google advertisements had been linked to campaigns that collected recovery phrases. These operations, which surfaced in September and early October, have not been connected to the hardware implant cases.

The company reiterated that all official communications about the investigation would come from Ledger or verified retail partners such as MediaMarktSaturn. Customers were told to ignore unsolicited messages or calls offering support.

Investigation Scope and Future Steps

Ledger stated that its Donjon team will continue analyzing all submitted devices. Support staff will review additional customer reports. The firm has not disclosed how many units may require inspection or when retail sales in Germany could resume.

The company noted that circulating online figures and claims about the incidents require independent verification before being treated as definitive. Ledger plans to provide further updates as the probe advances. Users are encouraged to remain vigilant and only engage with official channels for any developments related to the hardware wallets.