BTC $83,306 
ETH $2,507 
USDT $0.9993 
BNB $741.46 
XRP $1.37 
USDC $0.9998 
SOL $106.96 
TRX $0.3281 
FIGR_HELOC $1.03 
ZEC $1,216 Ledger halts German retail sales amid hardware implant investigation
The hardware wallet maker suspended sales at MediaMarkt Saturn stores after reports of tampered devices in Germany.
Key takeaways
- Estimated losses spike. Loss estimates from CryptoBilis incidents have risen to $93 million since reports emerged on October 9.
- Recovery phrase theft. An unauthorized implant inside affected devices read customers' 24-word recovery phrases and transmitted them via cellular connection.
- No German fund loss. Ledger reported no loss of customer funds in the reported German case, though the investigation continues.
What happened
Ledger has suspended hardware wallet sales at MediaMarkt Saturn stores and online following a reported device implant involving a customer in Germany. The retailer halted sales with Ledger's agreement while an investigation into the incident continues.
The suspension centers on findings from a separate but related case involving modified Ledger devices sold through CryptoBilis, a Southeast Asian reseller. Researchers found that unauthorized hardware was used to capture wallet recovery phrases from affected devices.
The implant operates as a separate component inside the wallet enclosure. When customers set up their devices, the implant's microcontroller detects and decodes the 24-word recovery phrase displayed on the screen, then transmits the words over a cellular network using a provisioned eSIM.
Ledger's Donjon security team will examine devices submitted during the investigation while support staff review customer reports. The company stated it found no evidence that its infrastructure, systems or services had been compromised in either case.
Why it matters
The incidents raise concerns about the security of hardware wallets sold through third-party retail channels. Ledger's announcement comes days after initial reports of missing cryptocurrency from CryptoBilis customers, with loss estimates now reaching $93 million.
The implant's design means the compromised devices retain their normal function without showing signs of tampering. The Secure Element and operating system remain unmodified, and transaction signatures appear valid, making detection difficult for users.
Ledger urged customers who purchased wallets from CryptoBilis to avoid setting up unopened devices and warned that scammers could exploit the incident by contacting wallet owners and requesting their recovery phrases.
What is still unclear
- Ledger has not provided a date for when sales could resume at MediaMarkt Saturn or disclosed how many devices may require inspection.
- The company has not confirmed whether the German report is connected to other suspected cases of hardware tampering or identified the affected device model.
- Ledger stated it has not confirmed the total number of affected users or the total value lost, noting that circulating estimates have not been fully verified.
Questions readers ask
How did the implant steal recovery phrases?
The unauthorized component inside affected devices reads the 24-word recovery phrase during setup and transmits it over a cellular network using a provisioned eSIM. The implant sits inside the device enclosure without modifying the Secure Element or operating system.
Were customer funds lost in Germany?
Ledger reported no loss of customer funds in the reported German case, though the investigation continues. All confirmed losses are associated with wallets purchased through CryptoBilis.
When will Ledger resume sales at MediaMarkt?
Ledger has not provided a date for when sales could resume at MediaMarkt Saturn stores and online. The suspension will remain in place while the investigation continues.
What should CryptoBilis customers do?
Ledger urged customers who purchased wallets from CryptoBilis to avoid setting up unopened devices. Customers with concerns about purchased devices should contact Ledger's official support service.
