Ledger details CryptoBilis implant as MediaMarkt pauses sales

Ledger confirmed that an unauthorized implant in a device sold by Southeast Asian reseller CryptoBilis captured users’ recovery phrases during setup, as MediaMarktSaturn paused Ledger sales across Europe after a German customer reported a tampered unit. Ledger’s security team said the device read the 24 words shown during setup and sent them over LTE through a provisioned eSIM, according to The Block’s report on Ledger’s findings and the sales pause.

The recovery phrase acts like a master key: someone who obtains it can access the crypto accounts it protects. The implant’s path was direct. During setup, the user entered or checked the words on the wallet. The hidden hardware captured them, then used its cellular connection to transmit them outside the device. The attacker could then use the phrase to access the associated assets.

What could the implant change inside the wallet?

Ledger’s Donjon security team said the implant did not modify the wallet’s Secure Element chip or operating system, or alter transactions and signatures. The compromised step was the handling of the recovery phrase during setup. That distinction matters: the device could still carry out its normal signing function while a separate component copied the information needed to take control of the wallet.

Ledger said it had no indication that its own infrastructure, systems or services were compromised. The company asked CryptoBilis to stop sales and shipments while it investigated. Ledger said online estimates of losses and affected users came from third parties and remained unverified.

Why did MediaMarktSaturn pause European sales?

MediaMarktSaturn stopped selling Ledger devices in stores and online from October 13 after a customer in Germany reported finding an implant. Ledger said no funds were reported lost in that case. The customer’s report was separate from the confirmed CryptoBilis cases, and Ledger’s October 15 update said its team had bought and examined devices in Germany and found every unit it checked clean.

The retailer said it removed Ledger products from its stores and online platforms and was in contact with the manufacturer, The Block reported. The pause followed a report of suspected tampering; it does not by itself confirm that European retail stock was compromised.

What has Ledger confirmed about the investigation?

Ledger’s latest investigation update says the implant was found in devices sold through resellers in Southeast Asia, after the devices had left Ledger’s control. The company says its Donjon lab took the implant apart, and it asked authorized resellers and distributors in Southeast Asia and Hong Kong to suspend sales while checks continue.

For customers, the key exposure is whether a device captured their recovery phrase during setup. A hardware wallet can protect signing keys inside its chip, but a phrase copied before or outside that protected process can still give an attacker access to the assets.

Sources

• The Block’s report on Ledger’s findings and the sales pause — theblock.co
• investigation update — support.ledger.com