- MediaMarktSaturn stopped Ledger sales across its stores and online channels after a German researcher reported suspicious hardware modifications.
- Ledger separately confirmed unauthorised implants in devices sold through Southeast Asian reseller CryptoBilis, with traced losses reaching up to US$93.2 million.
- The implant could capture a user’s 24-word recovery phrase during setup and transmit it wirelessly via eSIM and LTE.
- Ledger asked distributors across several Asian markets to suspend sales while investigating the supply chain, but said its own systems and direct channels showed no signs of compromise.
Following earlier reports of alleged tampering with crypto wallet devices made by French firm Ledger, one of Europe’s largest electronics retailers has pulled the devices off its shelves. MediaMarktSaturn said it has stopped the sale of Ledger devices in all its physical stores and online shops.
This was confirmed by Ledger in a 13 October post on X and was labelled as being “with Ledger’s alignment”. The move comes after a German security researcher bought two Ledger devices at different locations and claimed that the devices had been tampered with.
The unconfirmed claims state that cables and cellular modules had been added to the devices, in what the researcher, named Johannes, framed as “spyware”. Ledger assured that “no loss of funds were reported”.
Former Mt. Gox CEO Mark Karpelès says he has been looking into suspicious hardware modifications since September.
Read also: Critical XRP Ledger Bug Could Have Allowed XRP to Be Minted From Nothing
What We Know So Far
On 9 October, Ledger said it was investigating loss of funds involving devices sold by reseller CryptoBilis and had asked the reseller to halt all shipments.
Ledger is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBillis. As a precaution, and pending the results of our investigation, we have asked CryptoBillis to pause all sales and shipments of Ledger devices.
Ledger All users who bought devices in the preceding 90 days were urged not to initialise their wallets if they hadn’t done so and, if they had, to consider moving their crypto assets.
Blockchain investigators initially estimated losses of more than US$86 million (AU$123 million), and a day later Ledger confirmed that an unauthorised implant had been found in at least one device. The estimated losses have since increased, with blockchain analytics firms tracing as much as US$93.2 million (AU$133.2 million), although Ledger has not confirmed the total amount stolen.
Ledger later said the confirmed losses involved devices sold through CryptoBilis and that it had not verified a fund drain linked to a device purchased elsewhere.
Separately, Johannes subsequently reported buying his devices from German MediaMarkt stores and finding suspicious components.
On 13 October, Karpelès posted on X that he had been sent a Ledger device that had a spy implant. The device had been bought back in June at Singapore’s Changi Airport. Ledger has not confirmed that the Singapore device is linked to the CryptoBilis cases.
Ledger confirmed that a tampered device sold through CryptoBilis containing an embedded microcontroller could capture the 24-word recovery phrase as it appears on screen during setup and transmit it wirelessly via an eSIM and LTE, with no need to attack the secure chip or firmware.
Related: Ledger Launches Open-Source AI Toolkit With Hardware-Enforced Approval for Crypto Transactions
Ledger also asked resellers and distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to suspend sales and remove its devices from shelves while the investigation continues.
The wider suspension is precautionary as Ledger investigates where the confirmed tampering occurred in the distribution chain. The company said it had found no indication that its own systems or direct sales channels had been compromised.
Be the first to comment