MediaMarktSaturn pulled the full Ledger range within four days of losses surfacing at another reseller
MediaMarktSaturn removed all Ledger products from its stores and online platforms over tampering reports. The public German evidence is an X user's claim that two wallets held cellular modules. Ledger did not answer Cointelegraph on whether it has confirmed any tampered device in Europe.
The Investor · Invest desk
October 9, CryptoBilis customers begin reporting missing cryptocurrency. October 10, Ledger confirms the implant. October 12, Bitquery estimates about $102 million in suspected losses across 324 wallets. October 13, Ledger statement says MediaMarkt Saturn suspended Ledger sales.
| Date | Event | Claim |
|---|---|---|
| October 9, 2026 | CryptoBilis customers begin reporting missing cryptocurrency | 16 |
| October 10, 2026 | Ledger confirms the implant | 16 |
| October 12, 2026 | Bitquery estimates about $102 million in suspected losses, 324 wallets | 18 |
| October 13, 2026 | Ledger: MediaMarkt Saturn suspended Ledger sales | 1 |
What happened
- Ledger said no customer funds were lost in the German case and that it found no evidence its infrastructure, systems or services were compromised.
- Ledger confirmed an implant in CryptoBilis devices on Oct 10, a day after customers began reporting missing cryptocurrency on Oct 9.
- On Oct 12 Bitquery estimated suspected losses of about $102 million across 324 wallets, an amount Ledger has not verified.
- Former Mt. Gox CEO Mark Karpeles said a Ledger Flex bought at Singapore's airport held a spy implant, and Ledger answered by pointing users to its CryptoBilis update.
Why it matters
- What it limits constraint An owner who already set up a CryptoBilis unit cannot repair it by restoring the phrase elsewhere, since Ledger says that does not protect exposed funds. The remedy is a new device and a new phrase.
- Who's exposed exposure For any third-party buyer, the point of exposure Ledger documented is first setup: the implant read recovery phrases as they were displayed and sent them out over LTE.
- What it sets up precedent Other sellers of custody hardware now have a reference point: at most four days from first complaints at one reseller to a full brand removal at another.
- Who has to decide decision Buyers who planned to get a Ledger at MediaMarktSaturn must wait or switch sellers, with no restart date for sales announced.
Next story · Invest · yesterday
Bitquery counts $102 million drained from 324 Ledger-linked wallets across six chainsConfirmed6 publishers
Ledger said every fund loss it verified in the CryptoBilis investigation involved devices bought from that reseller, and that it had not confirmed any theft involving signers from other channels [7]. Germany adds a retailer to the story and little else yet: Ledger's statement left out the device model, the store and the method of modification [3], and whether the German report connects to other suspected cases is a question the company has left open [4]. The retailer's spokesperson was more emphatic. "We take this incident very seriously," the spokesperson told Cointelegraph [10].
The dollar figure is a total whose parts we cannot see. Divide the Bitquery estimate by its wallet count and each wallet averages about $315,000 [20]. That average implies either that a few very large holders dominate the total or that the wallet count is loose (the published figures do not settle which).
The implant's design bears on retail risk more than the dollar total does. The component used a separate microcontroller and an eSIM, and it left the Secure Element, the operating system and the transaction signatures unchanged [6]. In our view, a device that signs correctly therefore proves nothing about whether its recovery phrase stayed private.
The pull costs MediaMarktSaturn one brand's sales for as long as Ledger's Donjon team takes to examine the devices it receives [15]. We see three ways that examination ends. Donjon could find an implant in a unit bought at a MediaMarkt store; with the X user known as Johannes claiming two wallets from separate stores [11], that would put the fault upstream of any single outlet and make retail tampering a confirmed risk for third-party buyers. It could find unmodified units, in which case the removal was a precaution. Or it could find modified units it cannot trace to the shelf, and the question stays open.
We think retail tampering remains a hypothesis for buyers outside CryptoBilis, though Ledger itself said it is investigating reports beyond that reseller [12]. A single implant that Donjon finds in a unit bought from a store would prove our view wrong.
What to watch
- Donjon's findings on devices received from Germany, and whether any unit bought at a MediaMarkt store carries a cellular module.
- Whether Ledger addresses the Singapore airport Flex claim directly instead of referring users to the CryptoBilis update.
- Whether Ledger verifies Bitquery's $102 million and 324-wallet estimate, and when it says sales will resume.
Information, not investment advice. This story is general information about companies and markets, drawn from cited reporting. It is not a recommendation to buy, sell or hold any security; check the cited sources before acting.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+25
- Incentives
- Not scored
- Confidence60
Perspective Coverage
6 publishers- Builder
- Builder 23%
- Operator
- Operator 42%
- Investor
- Investor 35%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
According to an October 13 statement from Ledger, MediaMarkt Saturn had suspended Ledger hardware wallet sales in physical stores and online, with Ledger's agreement, following a reported device implant involving a customer in Germany.
- [2]
Ledger said no customer funds were lost in the reported German case and that it found no evidence its infrastructure, systems or services had been compromised.
- [3]
Ledger's statement did not identify the affected device model, the store where it was purchased or the method used to modify it.
- [4]
Ledger has not confirmed whether the German report is connected to other suspected cases of hardware tampering.
- [5]
Ledger's Donjon researchers confirmed that an unauthorized component inside an affected signer could read recovery phrases displayed during device setup and transmit them through an LTE cellular connection.
- [6]
The implant used a separate microcontroller and an eSIM to capture recovery words without changing the device's Secure Element, operating system or transaction signatures.
- [7]
Ledger said every fund loss it had verified in the CryptoBilis investigation involved devices purchased through that reseller, and it had not confirmed any theft involving signers bought through other distribution channels.
- [8]
Ledger told customers who had used potentially affected CryptoBilis wallets to transfer their cryptocurrency to new devices initialized with new recovery phrases, and warned that restoring an existing recovery phrase on another device would not protect funds if the original phrase had already been exposed.
- [9]
A MediaMarktSaturn spokesperson told Cointelegraph by email on Tuesday that the MediaMarktSaturn Retail Group has removed all of the manufacturer's products from its stores and online platforms and is in contact with the manufacturer.
- [10]
"We take this incident very seriously," the MediaMarktSaturn spokesperson told Cointelegraph.
- [11]
An X user known as Johannes claimed on Monday that he purchased two Ledger wallets from separate MediaMarkt stores and that both contained unauthorized cables and cellular modules.
- [12]
Ledger said Tuesday that implants transmitted users' recovery phrases over cellular networks and that it was investigating reports beyond CryptoBilis.
- [13]
Cointelegraph asked Ledger whether it had confirmed any tampered devices in Europe and received no response by publication time.
- [14]
Ledger has not provided a date for when sales could resume or disclosed how many devices may require inspection.
- [15]
Ledger's Donjon security team will examine devices received as part of the investigation while support staff review customer reports.
- [16]
Ledger confirmed the implant on October 10 after receiving complaints of missing cryptocurrency from CryptoBilis customers beginning October 9.
- [17]
At most four days passed between the first CryptoBilis complaints on October 9 and the October 13 statement recording that MediaMarkt Saturn had stopped selling Ledger devices.
- [18]
Blockchain analytics firm Bitquery estimated suspected losses of approximately $102 million across 324 wallets in an October 12 analysis.
- [19]
Ledger has not verified the Bitquery amount, the total number of victims or whether all the suspicious transactions were caused by modified devices.
- [20]
Bitquery's estimated $102 million across 324 wallets averages about $315,000 per wallet.
- [21]
Former Mt. Gox CEO Mark Karpeles said Tuesday that a Ledger Flex purchased at Singapore's airport contained a spy implant; Ledger responded by referring users to its latest CryptoBilis investigation update without directly addressing the Singapore case.
Sources
6 independent publishers whose own reporting we read for this story.
- cointelegraph.comMediaMarktSaturn pulls Ledger products amid tampering reports
1 article · October 13, 2026
- crypto.newsLedger suspends retail sales in Germany as wallet implant probe continues
1 article · October 13, 2026
- cryptobriefing.comMediaMarktSaturn halts Ledger sales amid spyware concerns
1 article · October 13, 2026
- news.bitcoin.comLedger Spy Implant Scandal Prompts Mediamarkt Sales Freeze
1 article · October 13, 2026
- runtimewire.comLedger implants surface in German retail as MediaMarkt pulls its devices
1 article · October 14, 2026
- scworld.comMediaMarktSaturn pulls Ledger products amid hardware wallet concerns
1 article · October 14, 2026
Topics and entities
Entities
- Ledger
- Ledger Donjon
- MediaMarktSaturn
- Bitquery
- Trezor
- Mark Karpelès
- CryptoBilis