Ledger halts reseller sales in Europe as confirmed seed-phrase implant surfaces at MediaMarkt

MediaMarkt Saturn pulls Ledger devices from European shelves

MediaMarkt Saturn stopped selling Ledger hardware wallets in its stores and online across Europe on October 13 after a German customer reported finding an implant inside a device, with no loss of funds reported in that case. Ledger confirmed the suspension and said the retailer removed all of the manufacturer's affected products while the two companies stay in contact.

The move extends a supply-chain scare that began in Southeast Asia. Ledger confirmed on October 10 that signers sold by the regional reseller CryptoBilis contained an unauthorized hardware component, and its security team, the Donjon, published a full analysis of how the implant works on October 13, saying in a post on X that it reads the 24-word recovery phrase straight off the device screen.

For a product whose core promise is that the keys to a wallet never leave a sealed, tamper-resistant chip, an implant that copies the recovery phrase during setup defeats the reason buyers pay a premium for hardware in the first place.

How the implant steals the phrase

The mechanism, as Ledger's Donjon team describes it, is straightforward and does not touch the device's cryptography. A separate circuit board hidden inside the enclosure watches what the screen displays. During setup, the signer shows the user its 24-word recovery phrase, the only sequence that controls the wallet's funds. When the implant detects those screens, a microcontroller decodes the words and transmits them over a cellular network using a provisioned eSIM, a SIM chip embedded in the board itself.

That design means the attacker never has to break the Secure Element, the tamper-resistant chip that stores private keys. Ledger said the implant does not modify the Secure Element or the Ledger operating system and does not alter transactions or signatures. It simply copies the one secret a user is supposed to write down and keep offline, then phones it home.

All confirmed fund losses disclosed on October 9 involve signers sold through CryptoBilis, and Ledger said it has not verified a drain linked to a signer bought elsewhere. Third-party onchain estimates put losses above $86 million across Bitcoin, Ethereum and Tron, but Ledger said figures circulating online come from third parties and it has not fully verified them.

Spread beyond one reseller, and what buyers should do

The geographic reach is now the open concern. A user posting on X under the name Johannes said he bought two Ledger devices at separate MediaMarkt stores in Germany and found unauthorized cables and cellular modules inside both, adding that store records pointed to distributor Aqipa GmbH. Those claims are not independently verified, and Ledger has not confirmed any link between the German devices and the CryptoBilis case. Former Mt. Gox chief Mark Karpeles also reported that a Ledger Flex bought at Singapore's airport contained a spy implant; Ledger has not tied that device to the same incident.

Ledger's guidance to buyers is unchanged: anyone who purchased a signer from CryptoBilis and has not set it up should not set it up and should contact Ledger Support instead. Those who already set one up should move their assets promptly to a new signer with a new recovery phrase. The company added that anyone who lost funds should coordinate with law enforcement before opening the device.

Competitors are moving too. OneKey revoked CryptoBilis's reseller authorization and is offering free replacements for devices bought through the reseller between March 1 and October 13, while Trezor dropped the reseller as a precaution and is trimming its reseller network, with notified resellers losing authorization on January 1, 2027.

The post Ledger halts reseller sales in Europe as confirmed seed-phrase implant surfaces at MediaMarkt appeared first on Techreport.