MediaMarkt Saturn has suspended Ledger hardware wallet sales in physical stores and online following a reported device implant in Germany. According to Ledger's October 13 statement, the retailer stopped selling the devices with the company's agreement while an investigation into the reported hardware tampering continues. No loss of customer funds has been reported in connection with the German case, and Ledger has found no indication that its infrastructure, systems or services were compromised. The suspension covers both physical retail locations and online sales, with Ledger not providing a date for when sales could resume or disclosing how many devices may require inspection.
A crypto trader lost 80 Bitcoin (BTC) worth approximately $6.6 million in a single transfer on Friday, marking the latest in a series of reported losses from new Ledger devices. According to blockchain tracker Lookonchain, the trader purchased the coins about four months ago at roughly $65,000 each, totaling around $5.2 million. The coins had sat for 10 days on a new Ledger hardware wallet before being transferred out at 05:54 UTC on October 9. With Bitcoin price trading above $83,000, the trader had achieved a paper profit of $1.38 million before the coins disappeared. The same block of transactions carried at least six other large transfers into addresses that blockchain analysts link to the ongoing drain.
Ledger has confirmed that all confirmed cases in the reported wallet draining incident involve devices sold through CryptoBilis, a Southeast Asian reseller. According to Ledger's October 13 statement, the company found an unauthorized hardware implant in one affected device while investigating the October 9 incident. Ledger has asked CryptoBilis to halt sales of its hardware wallets as a precaution pending investigation results. The Malaysian reseller, founded in 2020, sells crypto merchandise and Ledger devices across Malaysia, Indonesia, and the Philippines. Ledger's investigation remains open and the company says it is working with authorities and contacting affected users, with no indication that its own systems or direct sales channels were compromised.
Ledger's Donjon researchers have confirmed that an unauthorized component inside an affected signer could read recovery phrases displayed during device setup and transmit the information through an LTE cellular connection. The implant used a separate microcontroller and an eSIM to capture the recovery words without changing the device's Secure Element, operating system or transaction signatures. Ledger confirmed the presence of the implant on October 10 after receiving complaints of missing cryptocurrency from CryptoBilis customers beginning October 9. Blockchain analytics firm Bitquery estimated suspected losses of approximately $102 million across 324 wallets in an October 12 analysis, though Ledger has not verified this amount or the total number of victims.
Blockchain analytics firm Arkham has provided detailed tracking of the reported losses, creating a 'ledger-drainer' label covering 152 addresses and publishing images showing how funds moved across different blockchains. At the time of writing, the labeled wallets held approximately $71.6 million, including around $29.4 million in Ether, $17.68 million in Bitcoin, $13.65 million in USDD, and $10.85 million in USDT. Independent investigators have estimated the suspected thefts above $86 million, though Ledger has not confirmed this total. The actual figure represents an estimate, as the total suspected loss may be higher due to funds potentially moving out of tracked wallets and changing crypto prices affecting dollar values. MistTrack has offered a higher figure, possibly reaching $90 million, while Tether has frozen USDT at addresses linked to the theft.
Ledger issued specific warnings to recent buyers from the affected reseller and has expanded security alerts following the German incident. As reported by Ledger Support, buyers who purchased from CryptoBilis in the past 90 days were advised not to set up their devices. Users who had already set up their devices were instructed to move funds to a new device with a new seed phrase. A seed phrase is the 24-word backup that controls a wallet, making this a critical security measure for affected users. The company advised customers who purchased devices from the reseller within the past 90 days not to begin setting them up, while those who have already activated their wallets should consider moving their assets to a new Ledger device with a newly generated recovery phrase. Ledger also warned that restoring an existing recovery phrase on another device would not protect funds if the original phrase had already been exposed.
A supply-chain attack involving tampered devices could be one possible explanation for the reported losses. In such a scenario, an attacker could supply a device with a recovery phrase they already know, allowing them to access funds deposited into the wallet at a later date. This would differ from a breach of Ledger's own systems, though there is no confirmation that device tampering or pre-generated recovery phrases caused the reported losses. The investigation raises critical questions about the distribution chain between manufacturers and buyers, as a device can move through multiple handoffs from factory to distributor, warehouse, national importer, reseller, online marketplace and delivery carrier before reaching a user. Ledger's confirmation of a reseller link locates a common point of sale, but it does not yet pinpoint the point of modification, with alteration potentially occurring at more than one handoff in the distribution process. The company's Genuine Check authenticity test verifies the security chip but not every component around it, leaving room for hidden spy chips to pass undetected.
