MediaMarktSaturn has removed all Ledger products from its stores and online platforms. The decision follows reports of tampered hardware wallets bought at MediaMarkt stores. On Tuesday, Ledger said it is investigating reports beyond CryptoBilis, the Southeast Asian reseller at the center of the confirmed thefts.
A spokesperson for the retail group told Cointelegraph: “The MediaMarktSaturn Retail Group has removed all of the manufacturer’s products from its stores and online platforms and is in contact with the manufacturer. We take this incident very seriously.” The group operates the MediaMarkt and Saturn chains across Europe.
Two Devices, Two Stores
On Monday, security researcher Johannes, who posts on X as @0xJohannes_, said two Ledger devices he bought at two separate MediaMarkt stores contained hardware that did not belong there. He described extra cables and a cellular module inside the devices. The design matches the implants Ledger has described in the confirmed cases: hardware that reads the 24-word recovery phrase from the screen during setup and transmits it over LTE.
He bought one of the devices roughly two weeks earlier. It had not moved any funds. Johannes gave two possible explanations: the implant had failed, or an attacker was waiting before striking. He presented both as hypotheses, not findings. 
Citing store records, Johannes traced the stock to Aqipa GmbH, a distributor supplying MediaMarkt and Saturn stores across Europe. That detail rests on his account alone. No second source has confirmed it, and nothing in his reporting suggests Aqipa took part in any tampering.
The Confirmed Case in Asia
The confirmed thefts began in Southeast Asia. On October 9, Ledger opened an investigation after users reported funds draining from wallets bought through CryptoBilis. The company asked the reseller to stop selling and shipping its devices. One day later, Ledger confirmed that a device belonging to one impacted user contained an unauthorized hardware implant.
On-chain researchers have traced more than $93 million in losses across more than 300 wallets. Ledger has not confirmed that figure.
According to Ledger, the implant leaves the secure element, the operating system, and transaction signing untouched. It sits inside the enclosure, reads the recovery phrase as the screen displays it during setup, decodes the words with a small microcontroller, and sends them over an LTE connection through an embedded SIM. Anyone holding the phrase can rebuild the wallet elsewhere and take the funds without ever touching the device.
In its 72-hour update, Ledger said every confirmed case still traces back to devices sold through CryptoBilis. It called the volume of affected devices limited. It also said its own systems and direct sales channels remain unaffected, and it has not confirmed that the devices reported in Europe belong to the same incident.
What Buyers Should Check
- Buy from the manufacturer or an authorized reseller, and treat the sales channel as part of the security model. Our self-custody guide gives the same advice: purchase directly from the manufacturer to avoid supply chain tampering.
- Follow Ledger’s guidance for CryptoBilis purchases. Devices bought from the reseller in the past 90 days should not be set up. Anyone who already set one up should consider moving funds to a new device with a newly generated recovery phrase.
- Run the manufacturer’s authenticity check, but treat it as one signal only. The reported implants leave the genuine secure element in place, so a passed check cannot rule out tampering.
- Never enter a recovery phrase into a phone, a computer, or a website. The phrase belongs on the device screen and on your backup, nowhere else. Ledger never asks for it by email, phone, or message, and anyone who does is running a scam.
- Do not open a device to inspect it yourself. Follow the manufacturer’s inspection guidance, and contact support if you cannot establish where a device came from.
Related Coverage
- Our Trezor Safe 7 review looks at a hardware wallet built around an auditable secure element.
- Our wallet guide rounds up the best hardware wallets for cold storage.
Ledger says it is reaching out to impacted users and working with authorities. The company is also reviewing the controls that apply to its direct sales and to its resellers, along with its anti-tamper protections. MediaMarktSaturn says it remains in contact with the manufacturer. Neither side has said when Ledger products might return to the shelves.
