In this article5 sections
MediaMarktSaturn has removed every Ledger product from its stores and online platforms while reports of tampered hardware wallets circulate, Cointelegraph reported. The parent company of European electronics retailer MediaMarkt confirmed the withdrawal to CoinPulseHQ by email on Tuesday, saying it takes the incident very seriously and is in contact with the manufacturer.
Key facts
- MediaMarktSaturn removed all of the manufacturer’s products from its stores and online platforms.
- An X user known as Johannes said Monday he bought two Ledger wallets from separate MediaMarkt stores and found unauthorized cables and cellular modules in both.
- Ledger said on Friday that it was investigating reports of losses tied to devices sold through Southeast Asian reseller CryptoBilis.
- Ledger said Tuesday that implants transmitted users’ recovery phrases over cellular networks and that it was investigating reports beyond CryptoBilis.
- Former Mt. Gox CEO Mark Karpelès said Tuesday that a Ledger Flex bought at Singapore’s airport contained a spy implant.
Investigations widen beyond Southeast Asia
The retailer’s decision closes a week in which the tampering reports moved from an initial Southeast Asian focus to claims in Europe and at a major travel hub. Ledger’s Friday statement addressed losses involving devices sold through CryptoBilis; by Tuesday the company had confirmed that unauthorized implants transmitted recovery phrases over cellular networks and that it was looking into reports beyond that reseller.
Also read: Ledger Probes $86M Theft as CZ Flags Supply Chain Attack
The Singapore claim came from Karpelès, who said a Ledger Flex purchased at the airport contained a spy implant. Ledger’s response referred users back to its latest CryptoBilis investigation update rather than addressing the Singapore case directly. CoinPulseHQ asked Ledger whether it had confirmed any tampered devices in Europe and received no answer by publication time.
For buyers, the practical concern is straightforward: a hardware wallet is meant to keep recovery phrases offline, and an implanted cellular module breaks that assumption by moving those phrases onto a network the owner does not control. The affected devices in Johannes’s account were bought through a mainstream European retail chain, not a secondary reseller, which likely factored into MediaMarktSaturn’s decision to pull stock while the manufacturer investigates. Comparable developments in the same period include Coldcard’s Oct. 11 statement that it was looking into how a phishing link appeared on its X account, and Ledger’s own Oct. 11 confirmation of an unauthorized hardware implant with losses that may exceed $86 million.
Also read: Ledger implant attack reaches Europe as AI finds XRP bug
Response from Ledger and retailers
MediaMarktSaturn has not said when the products might return to shelves, and its spokesperson did not elaborate on how the removal was carried out beyond confirming that all of the manufacturer’s products had been taken off store floors and online platforms. That phrasing points to a blanket halt rather than a targeted recall of specific batches or serial numbers, though the group has not described it that way.
Ledger has so far framed its public updates around the CryptoBilis investigation. The company has not published a list of affected retail channels, and it did not respond to questions about European devices before publication.
Why it matters
Hardware wallets exist so that private keys and recovery phrases never leave the device, and retail buyers generally treat store purchases as safer than second-hand or grey-market channels. The reports undermine that assumption by suggesting tampering can occur before a device reaches the shelf. European shoppers who recently bought a Ledger from MediaMarkt now have no certainty about the origin of their device, and other retailers that stock the brand face pressure to explain their own handling. The episode also strengthens the argument made in the wider market that custodial or exchange-traded products may carry less physical supply-chain risk than self-custody hardware.
What to watch
The next markers are Ledger’s follow-up on whether it has confirmed tampered devices outside CryptoBilis, and whether MediaMarktSaturn sets conditions or a timeline for restoring stock. Further reports from buyers in other retail channels would determine whether the withdrawals spread beyond one chain.
Reported by cointelegraph.com.
Source: Cointelegraph