Ledger confirms wallet implant as MediaMarkt halts sales

Ledger says modified hardware wallets sold by Southeast Asian reseller CryptoBilis contained hidden implants that copied users’ recovery phrases during setup. The devices could expose crypto funds to theft, and the incident led MediaMarktSaturn to pause sales of Ledger devices across Europe. The Block’s report on Ledger’s findings and the sales pause says the implant sent the 24-word phrase over a mobile connection.

How did the implant capture recovery phrases?

Ledger’s Donjon security team said the implant read the phrase from the device screen during setup and sent it over LTE, a mobile data network, using an eSIM. A recovery phrase is a set of words that can restore access to a crypto wallet. The implant did not alter Ledger’s Secure Element chip, operating system, transactions or signatures, according to the company’s findings reported by The Block.

Ledger said the confirmed cases of stolen funds it had reviewed involved devices sold through CryptoBilis. The company said it had no indication that its own systems or services were compromised. Online estimates put losses above $86 million across Bitcoin, Ethereum and Tron, but Ledger said it had not verified the total or the number of affected users.

Why did MediaMarkt stop selling Ledger devices?

MediaMarktSaturn halted in-store and online sales on October 13 after a customer in Germany reported finding an implant in a Ledger device. The retailer told The Block it removed the manufacturer’s products from its platforms and was in contact with Ledger. Ledger said no funds were reported lost in that customer’s case.

Ledger’s October 15 response to the hardware implant attack says its teams bought and opened devices from German stores and warehouses; every unit they examined was clean. That does not confirm the reported customer device was safe or tampered with. Ledger said it asked resellers and distributors in Southeast Asia and Hong Kong to suspend sales while it investigates.

What is Ledger changing for its resellers?

Ledger told authorized resellers that returned devices must never be resold, even if they appear unopened. It also directed them to keep products off shelves and displays, store them out of public view, and hand them to customers at purchase. Resellers must promptly report customer complaints about unusual devices.

The company described the incident as an attack on distribution after devices left its control. It said it is working with law enforcement and security partners and plans to share more technical details. Ledger advised people who lost funds to coordinate with law enforcement before opening their device.

References

• The Block’s report on Ledger’s findings and the sales pause — theblock.co
• response to the hardware implant attack — ledger.com