MediaMarkt Saturn Suspends Ledger Sales Amid Supply Chain Tampering Incident

This incident highlights vulnerabilities in the hardware supply chain that could undermine consumer trust in cryptocurrency security.

• Ledger disclosed unauthorized implants in hardware wallets sold through Southeast Asian reseller CryptoBilis, allowing potential data breaches.
• MediaMarkt Saturn suspended sales of Ledger products after a customer reported tampering in Germany, despite no confirmed fund losses in that case.
• Estimated losses from suspected drains reached $93 million, prompting Ledger to review its supply chain and security protocols.

• Prior reports indicated cryptocurrency drains from Ledger devices purchased via CryptoBilis, with initial loss estimates at $86 million before the October 13 announcement.
• Ledger's Donjon security team identified implants that could read recovery phrases and transmit data via LTE, raising alarms about the integrity of the devices.
• Competitor Trezor responded by tightening its reseller network, indicating a broader industry concern about hardware wallet security.

On October 13, 2026, Ledger publicly confirmed the presence of unauthorized implants in devices sold through CryptoBilis, a Southeast Asian reseller. This revelation followed reports of significant cryptocurrency drains from these wallets, with initial estimates suggesting losses of $86 million. The situation escalated when a customer in Germany reported tampering, prompting MediaMarkt Saturn to suspend all sales of Ledger products both online and in-store as a precautionary measure.

The implants, identified by Ledger's Donjon security team, were designed to capture 24-word recovery phrases during device setup and transmit this sensitive information via LTE using an embedded SIM card. This method did not alter the secure element or operating system of the devices, making detection difficult for users. Ledger emphasized that all verified losses were traced back to CryptoBilis, and broader estimates of $93 million in potential losses remain unverified.

In response to the incident, Ledger urged caution among affected purchasers and provided guidelines for inspecting devices. The company also requested that resellers in seven Asian markets suspend sales of Ledger products. Meanwhile, rival manufacturers like Trezor began reviewing their reseller networks to prevent similar incidents, indicating a ripple effect across the industry.

The incident has raised significant concerns about supply chain security in the hardware wallet market. As cryptocurrency adoption grows, so does the potential for targeted attacks on hardware wallets, which are often seen as a secure method for storing digital assets. The implications of this incident extend beyond Ledger, as it may prompt increased scrutiny and regulatory oversight of hardware wallet manufacturers and their supply chains.

• Cryptocurrency investors: Those who own Ledger wallets may face heightened anxiety about the security of their assets.
• Retailers: MediaMarkt Saturn and other retailers selling Ledger products will experience sales disruptions and potential reputational damage.
• Resellers: Companies like CryptoBilis may face legal and financial repercussions, impacting their business operations.
• Competitors: Other hardware wallet manufacturers will likely reassess their security protocols and reseller partnerships to avoid similar incidents.

• Regulatory responses: Watch for potential regulatory actions aimed at enhancing security standards for hardware wallets, which could reshape the market.
• Consumer trust metrics: Monitor how consumer confidence in hardware wallets evolves in the wake of this incident, as it could impact sales across the industry.
• Security audits: Keep an eye on announcements from Ledger and its competitors regarding security audits and improvements to their supply chains.