BTC $83,162 
ETH $2,506 
USDT $0.9993 
BNB $741.80 
XRP $1.37 
USDC $0.9998 
SOL $107.28 
TRX $0.3275 
FIGR_HELOC $1.05 
ZEC $1,205 German Ledger Reseller Pauses Sales After $86M Draining Incident
MediaMarkt stopped selling Ledger wallets after spyware was found in tampered devices linked to $86 million in drained funds.
Key takeaways
- $86M estimated loss. Blockchain investigator Specter estimated $86 million was drained from tampered Ledger devices.
- One implant verified. Ledger confirmed only one unauthorized hardware implant in an affected user's device to date.
- 81,000 Trezor records leaked. Trezor reported a separate breach where 81,000 customer details were leaked via a third-party partner.
What happened
Official European Ledger reseller MediaMarkt has paused all sales of the hardware wallets after reports that devices sold by multiple resellers were fitted with spyware. The German retailer told Cointelegraph it removed all Ledger products from its stores and online platforms and is in contact with Ledger about the incident.
The issue first came to light last week when customers in Southeast Asia reported losing funds after purchasing Ledger devices from Malaysia-based reseller CryptoBilis. Ledger confirmed one affected user's device contained an unauthorized hardware implant that could read the wallet's 24-word recovery phrase and transmit it via an attached eSIM. CryptoBilis has also halted sales while the investigation continues, and Ledger advised affected customers not to set up their devices and contact support.
Why it matters
The incident highlights ongoing supply chain risks for hardware crypto wallets, which store users' private keys offline. Ledger has only confirmed drains linked to CryptoBilis, but former Mt. Gox CEO Mark Karpelès has found spyware in devices from MediaMarkt, Philippine reseller LazMall, and a Singapore airport vendor, though Ledger has not verified those drains. Competitor Trezor preemptively reduced its reseller count as a cautionary measure, noting no evidence its own devices were compromised.
Background
Hardware wallet makers have faced repeated security incidents in 2026. In July, a firmware bug in Coldcard devices allowed hackers to steal close to $120 million in bitcoin due to faulty seed generation that let attackers guess investor seedphrases. Last month, Trezor reported close to 81,000 customer details were leaked after its third-party fulfillment partner suffered a data breach. Earlier in the year, scammers used Ledger customer data obtained via payment processor Global-e to send phishing emails.
What is still unclear
- Ledger has not verified the $86 million total loss estimate from third-party blockchain investigator Specter, and has not confirmed any drains linked to devices purchased from resellers other than CryptoBilis.
Questions readers ask
Is my Ledger device safe if I bought it from MediaMarkt?
Ledger has not confirmed any drains linked to MediaMarkt devices, but is reviewing reports of implants in devices from the reseller. Contact Ledger support for guidance if you have concerns.
How much money was stolen in the Ledger draining incident?
Blockchain investigator Specter estimated $86 million in total losses, but Ledger has not fully verified this figure and has not confirmed the total number of affected users.
What should I do if I bought a Ledger from CryptoBilis?
Ledger has advised customers who purchased devices from CryptoBilis to not set up their wallets and contact the Ledger support team immediately.
