Ledger implant probe prompts MediaMarkt sales halt in Europe
Ledger says an implant copied recovery phrases from CryptoBilis wallets over LTE; MediaMarkt Saturn paused European sales after a customer report in Germany.
By Crypto Readout Editorial3 min read#484ce7
Ledger said an unauthorized implant in a signer sold through CryptoBilis could read a user’s 24-word recovery phrase during setup and send it over LTE. The company’s Donjon security team described the mechanism in an update reported by The Block. Separately, MediaMarkt Saturn paused sales of Ledger devices in its European stores and online on Oct. 13, after a customer in Germany reported a tampered device.
In a hardware wallet, the recovery phrase is the key that can recreate access to its crypto funds. During setup, the Ledger screen displays those words. The implant’s microcontroller reads and decodes them, then uses a provisioned eSIM to transmit them over a mobile network. Anyone who obtains the phrase can restore the wallet elsewhere and move its funds.
How did the implant capture the recovery phrase?
Ledger’s explanation, reported by CoinDesk, is that the hidden hardware read the words from the device screen during setup, then sent them out over LTE. The route is like someone copying a key while it is briefly visible, then sending the copy away: once an attacker has the phrase, they do not need the original signer to access the wallet.
Ledger said the implant did not alter the device’s Secure Element, operating system, transactions or signatures. That means the device could still appear to work normally while the phrase was exposed. The attack involved physical hardware in the supply chain, rather than a breach of Ledger’s software or internal systems, according to the company.
What has Ledger confirmed about the affected devices?
Ledger confirmed an implant in an affected signer and said all confirmed losses in the incident reported on Oct. 9 involved devices sold through CryptoBilis, a Southeast Asian reseller. It has not verified the total number of users affected or the amount stolen. Onchain researchers’ estimates of losses exceeding $86 million remain unverified, The Block reported.
The company asked CryptoBilis to pause sales and shipments while it examines recovered devices. Ledger told customers who bought unused devices through the reseller not to initialize them. Users who already set one up should move their assets to a new device with a newly generated recovery phrase, the company said.
Why did MediaMarkt Saturn pause sales?
MediaMarkt Saturn stopped selling Ledger devices in stores and online across Europe after a German customer reported finding an implant. Ledger said no loss of funds was reported in that case. The retailer said it had removed the manufacturer’s affected products and was in contact with Ledger, according to The Block.
The German report is separate from Ledger’s confirmed CryptoBilis-linked losses. Ledger has not confirmed that the reported MediaMarkt device was part of the same incident. The distinction matters: the pause shows how a supply-chain investigation can affect sales beyond the reseller connected to confirmed losses, while the source and scope of the German report remain unresolved.