Ledger and MediaMarkt Saturn Suspend Sales in Germany to Assist Investigation
Ledger announced that it has coordinated with German retailer MediaMarkt Saturn to suspend online and offline sales of Ledger devices starting October 13, in order to assist with an investigation. This follows a report from a German user who discovered a suspected implant in their purchased device.
Currently, there are no reports of financial losses related to this German case. Ledger stated that there are no signs of intrusion into its infrastructure, systems, or services. The company's customer service is reviewing user-submitted reports, and its cybersecurity team, Donjon, will inspect the received devices. The company has not disclosed when sales will resume or how many devices need to be checked.
A spokesperson for the MediaMarkt Saturn group confirmed to the media that relevant products have been removed from stores and online platforms, and they are in contact with the manufacturer, treating the incident as serious. Some users have reported finding additional cables and cellular modules in devices purchased from different MediaMarkt stores, but these claims have not been independently verified.
This incident follows Ledger's confirmation that devices sold by Southeast Asian distributor CryptoBilis contained unauthorized hardware implants. This implant could read the 24-word recovery phrase displayed on the screen during setup and transmit it via LTE with a pre-configured eSIM, without modifying the secure element or operating system. On-chain analysis estimates related losses to be between $86 million and $102 million, involving hundreds of wallets, with all confirmed financial losses related to purchases from CryptoBilis.
Ledger reminds users that if they have questions about purchased devices, they can contact the support team through the official customer service website. The company will never proactively call or message users, nor will it ask for the 24-word mnemonic phrase. Many claims and data circulating online have not been verified, and scammers may exploit such incidents to perpetrate fraud; users should only obtain the latest information through official channels from Ledger and MediaMarkt Saturn.
The suspension of sales through retail channels has temporarily disrupted offline and online distribution, and users may turn to official direct sales or other authorized channels. The incident has been driven by user reports, and no financial losses related to the German case have been observed. Official channels and direct sales may benefit from increased trust, while third-party retailers face pressure on inventory and sales, with rising costs for supply chain reviews.
Source: Public Information
ABAB AI Insight
Ledger previously confirmed the presence of hardware implants in the Southeast Asian distributor channel during the CryptoBilis incident and requested the distributor to cease sales and operations. The company's Donjon team has publicly described the implant mechanism: the additional module reads the recovery phrase from the screen and transmits it via cellular network without touching the secure element. Following the report from the German retail channel, the company chose to coordinate with a major retailer to suspend sales rather than wait for further confirmations.
Capital and review resources are shifting from a broad third-party retail network to directly controllable nodes. MediaMarkt Saturn, as a large European electronics retail group (covering over a thousand stores across multiple countries), has forced Ledger to focus more on physical inspections in the distribution chain. Previously, Trezor also reduced the number of distributors after a similar incident, reflecting that hardware wallet manufacturers are shifting resources from channel expansion to individual partner reviews.
Similar to the early supply chain incidents around 2017, manufacturers are moving from reliance on authorized retailers to emphasizing official direct sales and verifiable channels, currently transitioning from open distribution expansion to controlling physical transfer nodes. MediaMarkt Saturn's actions have shifted third-party retail from a trust assumption to a temporarily isolated entity, making official channels and direct shipping the priority path.
This essentially represents a restructuring of the industry chain. The attack surface for hardware wallets has shifted from firmware and secure elements to the physical aspects from factory to retail shelves, with implants capable of transmitting information without modifying the core chip. Manufacturers and retailers are converting the distribution chain from assumed security to auditable control through sales suspensions, device recalls for inspection, and enhanced channel verification, as the reality of attackers choosing to operate in distribution rather than production has been repeatedly validated.
ABAB News · Cognitive Law
- Trust cost of retail channels = radius of diffusion for a single implant report
- Device security terminates before reaching the shelf; channel isolation is just the starting point
- Third-party retail expansion benefits while amplifying the exposure of physical implants.