Pascal

Nano

Saturn

<p>Anyone looking to buy a Ledger at MediaMarkt or Saturn today will find none. Since Tuesday, October 13, 2026, the electronics chain has stopped selling hardware wallets made by the French manufacturer in Germany, neither in its stores nor online. Ledger confirmed the step itself on X: MediaMarkt Saturn has halted sales "in coordination with Ledger" while the investigation runs. The trigger is the report of a customer in Germany who says he found an implant in his device.</p>
<p>The key context first: for the German case Ledger reports no lost customer funds and no indication of a breach of its own systems. All thefts confirmed so far go back to devices sold by the retailer CryptoBilis in Southeast Asia. The sales halt is a clear signal nonetheless, because it affects the country's largest electronics retailer. What follows is what is documented, what is open, and what to do if your Ledger came from a store.</p>
<h2 id="ledger-at-mediamarkt-and-saturn-what-applies-since-october-13">Ledger at MediaMarkt and Saturn: what applies since October 13</h2>
<p>Ledger made the sales halt public on October 13 in a <a href="https://x.com/Ledger/status/2109984923343782374" rel="noopener noreferrer nofollow">post on X</a>. According to it, MediaMarkt Saturn has discontinued the sale of Ledger devices while the investigation continues. The occasion is said to be the report of a customer in Germany about an implant. Ledger writes that there is no indication that infrastructure, systems or services were compromised, and that no customer funds were lost in this case. The security team Donjon is examining the devices sent in, and customer service is evaluating the reports.</p>
<p>MediaMarktSaturn confirmed to the industry service Cointelegraph that it had pulled all Ledger products from its stores and online platforms. It takes the incident "very seriously" and is in contact with the manufacturer, the crypto portal <a href="https://blocktrainer.de/blog/manipulierte-krypto-wallets-mediamarkt-zieht-ledger-geraete-aus-dem-verkauf-zurueck" rel="noopener noreferrer nofollow">Blocktrainer</a> quotes from the statement. Neither Ledger nor the retailer has said when the devices will return to the shelf. On returns of devices already sold there is likewise no information as of the afternoon of October 13.</p>
<p>How many devices have to be checked, and whether the German case is connected to the tampered devices from Southeast Asia, is open. The portal <a href="https://crypto.news/ledger-suspends-retail-sales-in-germany-as-wallet-implant-probe-continues/" rel="noopener noreferrer nofollow">crypto.news</a>, among the first outlets to report the halt, stresses that too.</p>
<figure><img src="https://cryptoticker-strapi-media.s3.eu-central-1.amazonaws.com/ledger_mediamarkt_saturn_verkaufsstopp_implantat_2_9be3cbeee9.webp" alt="Hands inspecting the seal of a shrink-wrapped hardware wallet under a magnifying lamp" width="1920" height="1080">
 <figcaption>
  An intact seal is no protection against tampering in the supply chain. Illustrative image, AI-generated.
 </figcaption>
</figure>
<h2 id="the-report-from-germany-two-devices-from-two-stores">The report from Germany: two devices from two stores</h2>
<p>The case was made public by a user who writes on X under the name <a href="https://x.com/0xJohannes_" rel="noopener noreferrer nofollow">@0xJohannes_</a>. At the weekend he reported a tampered device from a MediaMarkt store, and on Monday a second one from a different store, filming himself unboxing it. In both devices he says he found the same modifications: additional cables and a mobile network module. A member of staff confirmed to him that the second device was not another customer's return. By his own account he sent one device to Ledger and the other to Mark Karpelès, the former head of the exchange Mt. Gox, who has himself taken apart and documented tampered devices in recent days.</p>
<p>These details come from the customer himself. Ledger has not named the model, the store or the type of tampering in the German case. Our article of October 12 still carried the report from European retail as unconfirmed. With the sales halt the position has changed: manufacturer and retailer take the report seriously enough to sell nothing nationwide.</p>
<h2 id="what-ledger-has-confirmed-about-the-implant">What Ledger has confirmed about the implant</h2>
<p>Behind the sales halt stands the CryptoBilis case, which we have been covering since October 9. On October 10 Ledger confirmed that an unauthorised additional circuit board sat inside a device from that Southeast Asian retailer. According to the manufacturer's account, which <a href="https://www.coindesk.com/tech/2026/10/13/ledger-says-spy-chip-inside-cryptobilis-ledger-devices-transmitted-wallet-keys-over-mobile-network" rel="noopener noreferrer nofollow">CoinDesk</a> summarised on October 13, the implant works like this: a microcontroller of its own reads the 24 words of the recovery phrase off the display while the device is being set up, and sends them to the attackers over an eSIM via LTE mobile network.</p>
<p>The secure element, the operating system and the signatures of transactions were not altered, according to Ledger. Chief technology officer Charles Guillemet announced a review of reseller controls and of tamper protection. Chief executive Pascal Gauthier said the investigation should establish who tampered with the devices and at which point in distribution that happened. Ledger notes that every confirmed loss so far concerns a device from CryptoBilis. An outflow from a device bought elsewhere has not been verified.</p>
<h2 id="damage-of-more-than-100-million-with-no-figure-confirmed">Damage of more than $100 million, with no figure confirmed</h2>
<p>There is no official damage total, and Ledger names none itself. The estimates of on-chain analysts diverge, because they attribute different numbers of wallets to the case:</p>
<table>
 <thead>
  <tr>
   <th>Source</th>
   <th>Estimate</th>
   <th>As of</th>
  </tr>
 </thead>
 <tbody>
  <tr>
   <td>Galaxy Research (Alex Thorn)</td>
   <td>around $91 million</td>
   <td>October 9</td>
  </tr>
  <tr>
   <td>On-chain researchers via CoinDesk</td>
   <td>up to $93.2 million across more than 300 wallets</td>
   <td>October 13</td>
  </tr>
  <tr>
   <td>Bitquery via crypto.news</td>
   <td>around $102 million across 324 wallets</td>
   <td>October 12</td>
  </tr>
 </tbody>
</table>
<p>Tether has frozen USDT worth $10 million linked to the thefts, according to CoinDesk. For those affected that is a small ray of light, because frozen stablecoins can be returned later. Anything that flowed out in Bitcoin or Ether, by contrast, cannot be recovered.</p>
<figure><img src="https://cryptoticker-strapi-media.s3.eu-central-1.amazonaws.com/ledger_mediamarkt_saturn_verkaufsstopp_implantat_3_c1f6f49f32.webp" alt="Opened hardware wallet with an additional radio module and a thin antenna wire on the circuit board" width="1920" height="1080">
 <figcaption>
  This is how Ledger and Mark Karpelès describe the implant: microcontroller, eSIM and LTE radio beneath the display. Illustrative image, AI-generated.
 </figcaption>
</figure>
<h2 id="why-the-authenticity-check-does-not-help-here">Why the authenticity check does not help here</h2>
<p>Many Ledger owners rely on the genuine check in the Ledger Live app. It verifies that the secure element is genuine and that the firmware comes from Ledger. Those are precisely the parts the implant left alone. A tampered device therefore passes the check, as Karpelès showed on his test unit. The additional board can only be spotted by opening the casing.</p>
<p>An uncomfortable truth follows from that: it is not the device that decides your security, but the route by which it reached you, and the moment the 24 words stand on the display. Set up a tampered device and you give away your recovery phrase at the instant you write it down. Background on the sequence is in our article on <a href="https://cryptoticker.io/en/ledger-implant-hardware-wallet-confirmed/" rel="noopener noreferrer nofollow">Ledger confirming the implant in a hardware wallet</a>, and the prior history in the first report on the <a href="https://cryptoticker.io/en/ledger-hack-cryptobilis-86-million-hardware-wallet/" rel="noopener noreferrer nofollow">CryptoBilis case</a>.</p>
<h2 id="a-ledger-from-mediamarkt-or-saturn-return-new-phrase-moving-the-coins">A Ledger from MediaMarkt or Saturn: return, new phrase, moving the coins</h2>
<p>Ledger officially recommends swapping the device only to buyers from CryptoBilis. For devices from German retail there is no recommendation from the manufacturer yet. These steps serve as orientation for anyone who wants to be on the safe side:</p>
<ol>
 <li><strong>Device still shrink-wrapped or not set up:</strong> do not set it up. Ask the retailer whether it will take the device back, and contact official Ledger support. Devices bought online can usually be returned within 14 days.</li>
 <li><strong>Device set up, bought at MediaMarkt or Saturn:</strong> the safest solution is a new device straight from the manufacturer, a freshly generated recovery phrase and moving all coins onto it. Important: restoring the old phrase on a new device is no protection. Once it has been read out, the attacker knows it.</li>
 <li><strong>Device bought directly from Ledger:</strong> as things stand today there is no confirmed case from direct sales. Following the situation is enough here.</li>
 <li><strong>In every case:</strong> never enter your 24 words anywhere, neither on a website nor in a form nor over the phone. Ledger never calls unprompted, sends no direct messages and never asks for the recovery phrase.</li>
</ol>
<p>Fraudsters exploit situations like this deliberately. Fake Ledger pages turned up in Google search as early as October 11. How to spot them is in our guide to <a href="https://cryptoticker.io/en/ledger-fake-website-google-spot/" rel="noopener noreferrer nofollow">spotting a fake Ledger website in Google</a>. We advise non-experts against unscrewing the device: the warranty can lapse in the process, and without a reference image an implant is hard to tell apart from genuine components.</p>
<h2 id="buying-a-hardware-wallet-directly-from-the-manufacturer-what-it-achieves">Buying a hardware wallet directly from the manufacturer: what it achieves</h2>
<p>The case shows that every additional stop between factory and customer is a risk. A purchase in the manufacturer's own shop shortens the route to the minimum. That holds for Ledger as much as for Trezor, Tangem or OneKey. Which devices exist, how they handle recovery and what they cost is shown in our <a href="https://cryptoticker.io/en/comparison/hardware-wallets/" rel="noopener noreferrer nofollow">comparison of hardware wallets</a>. Our experience with the best-selling entry-level model is summarised in our test of the Ledger Nano S Plus.</p>
<p>A second protection is splitting up: larger amounts can be spread across several wallets, and anyone using a multisig setup needs several devices for a payout. A single tampered device then cannot give everything away.</p>
<h2 id="ledger-sales-halt-what-to-take-away">Ledger sales halt: what to take away</h2>
<p>The sales halt at MediaMarkt and Saturn is a precaution, not evidence of thefts in Germany. Losses are confirmed so far only for devices from Southeast Asia. What is also clear: an implant that passes the authenticity check makes the route of purchase the most important security question. Buy a hardware wallet and you are best served buying it directly from the manufacturer, setting it up yourself and keeping the 24 words to yourself. We will update this article as soon as Ledger or MediaMarktSaturn provide new information.</p>

MediaMarkt and Saturn halt Ledger sales after a customer reports an implant

Table of Contents

CryptoTicker ENG

Other articles published on Oct 14, 2026

SEC’s Missed Leadership Role May Slow or Shift Crypto Rulemaking

South Korea Blocks 27 Unregistered Crypto Exchanges, Including KuCoin

Four Records We Published Yesterday Firmed, Split, or Stayed Exactly Where They Were

Shiba Inu today: lowest daily level since September 18

Bitcoin Whale Holding Since March 2020 Moves All $377M of BTC

Moscow Exchange Eyes December Crypto Trading Service Debut

Join our free newsletter for daily crypto updates!