MediaMarktSaturn, the parent of the MediaMarkt electronics chain, announced that it has taken Ledger hardware wallets off its shelves and website. The retailer said it is in contact with the manufacturer and treats the incident with the utmost seriousness.
Alleged tampering details
A user identified as Johannes posted on X that two Ledger wallets bought from different MediaMarkt locations contained unexpected cables and a cellular module. According to the claim, the added hardware could relay a user’s recovery phrase via a mobile network. The allegations surfaced after Ledger disclosed that devices sold through the Southeast Asian reseller CryptoBilis were being investigated for similar losses.
Former Mt. Gox chief executive Mark Karpelès also reported that a Ledger Flex purchased at Singapore’s airport appeared to contain a spying implant. Ledger directed inquiries to its ongoing CryptoBilis investigation update but did not specifically address the Singapore case.
Ledger’s investigation
Ledger confirmed it is probing reports that certain devices may have been modified to exfiltrate recovery phrases. The company initially focused on units linked to CryptoBilis, a reseller operating in Southeast Asia, but later indicated the probe could extend to other sales channels. No definitive evidence of tampered devices in Europe has been publicly released, and Ledger has not responded to a request for comment from the reporting outlet.
Impact on users
If the claims are accurate, the compromised components could allow an attacker to capture the 24-word seed phrase that secures a wallet’s funds. Users who purchased Ledger products from MediaMarktSaturn or similar retailers are advised to verify the integrity of their devices, possibly by checking for unexpected hardware or contacting Ledger support. The situation underscores the importance of acquiring hardware wallets from trusted sources and performing thorough integrity checks before use.
Why it matters
The episode highlights a growing threat landscape for hardware-based crypto security, where physical tampering can undermine the core protection that these devices promise. Retailers’ swift removal of the products signals heightened vigilance, while Ledger’s broadened investigation may set precedents for how the industry responds to supply-chain attacks. For investors and everyday users, the incident serves as a reminder to scrutinize the provenance of security-critical hardware and to stay informed about manufacturer advisories.
