MediaMarkt and Saturn halt Ledger sales after a customer reports an implant

Anyone looking to buy a Ledger at MediaMarkt or Saturn today will find none. Since Tuesday, October 13, 2026, the electronics chain has stopped selling hardware wallets made by the French manufacturer in Germany, neither in its stores nor online. Ledger confirmed the step itself on X: MediaMarkt Saturn has halted sales "in coordination with Ledger" while the investigation runs. The trigger is the report of a customer in Germany who says he found an implant in his device.

The key context first: for the German case Ledger reports no lost customer funds and no indication of a breach of its own systems. All thefts confirmed so far go back to devices sold by the retailer CryptoBilis in Southeast Asia. The sales halt is a clear signal nonetheless, because it affects the country's largest electronics retailer. What follows is what is documented, what is open, and what to do if your Ledger came from a store.

Ledger at MediaMarkt and Saturn: what applies since October 13

Ledger made the sales halt public on October 13 in a post on X. According to it, MediaMarkt Saturn has discontinued the sale of Ledger devices while the investigation continues. The occasion is said to be the report of a customer in Germany about an implant. Ledger writes that there is no indication that infrastructure, systems or services were compromised, and that no customer funds were lost in this case. The security team Donjon is examining the devices sent in, and customer service is evaluating the reports.

MediaMarktSaturn confirmed to the industry service Cointelegraph that it had pulled all Ledger products from its stores and online platforms. It takes the incident "very seriously" and is in contact with the manufacturer, the crypto portal Blocktrainer quotes from the statement. Neither Ledger nor the retailer has said when the devices will return to the shelf. On returns of devices already sold there is likewise no information as of the afternoon of October 13.

How many devices have to be checked, and whether the German case is connected to the tampered devices from Southeast Asia, is open. The portal crypto.news, among the first outlets to report the halt, stresses that too.

The report from Germany: two devices from two stores

The case was made public by a user who writes on X under the name @0xJohannes_. At the weekend he reported a tampered device from a MediaMarkt store, and on Monday a second one from a different store, filming himself unboxing it. In both devices he says he found the same modifications: additional cables and a mobile network module. A member of staff confirmed to him that the second device was not another customer's return. By his own account he sent one device to Ledger and the other to Mark Karpelès, the former head of the exchange Mt. Gox, who has himself taken apart and documented tampered devices in recent days.

These details come from the customer himself. Ledger has not named the model, the store or the type of tampering in the German case. Our article of October 12 still carried the report from European retail as unconfirmed. With the sales halt the position has changed: manufacturer and retailer take the report seriously enough to sell nothing nationwide.

What Ledger has confirmed about the implant

Behind the sales halt stands the CryptoBilis case, which we have been covering since October 9. On October 10 Ledger confirmed that an unauthorised additional circuit board sat inside a device from that Southeast Asian retailer. According to the manufacturer's account, which CoinDesk summarised on October 13, the implant works like this: a microcontroller of its own reads the 24 words of the recovery phrase off the display while the device is being set up, and sends them to the attackers over an eSIM via LTE mobile network.

The secure element, the operating system and the signatures of transactions were not altered, according to Ledger. Chief technology officer Charles Guillemet announced a review of reseller controls and of tamper protection. Chief executive Pascal Gauthier said the investigation should establish who tampered with the devices and at which point in distribution that happened. Ledger notes that every confirmed loss so far concerns a device from CryptoBilis. An outflow from a device bought elsewhere has not been verified.

Damage of more than $100 million, with no figure confirmed

There is no official damage total, and Ledger names none itself. The estimates of on-chain analysts diverge, because they attribute different numbers of wallets to the case:

Tether has frozen USDT worth $10 million linked to the thefts, according to CoinDesk. For those affected that is a small ray of light, because frozen stablecoins can be returned later. Anything that flowed out in Bitcoin or Ether, by contrast, cannot be recovered.

Why the authenticity check does not help here

Many Ledger owners rely on the genuine check in the Ledger Live app. It verifies that the secure element is genuine and that the firmware comes from Ledger. Those are precisely the parts the implant left alone. A tampered device therefore passes the check, as Karpelès showed on his test unit. The additional board can only be spotted by opening the casing.

An uncomfortable truth follows from that: it is not the device that decides your security, but the route by which it reached you, and the moment the 24 words stand on the display. Set up a tampered device and you give away your recovery phrase at the instant you write it down. Background on the sequence is in our article on Ledger confirming the implant in a hardware wallet, and the prior history in the first report on the CryptoBilis case.

A Ledger from MediaMarkt or Saturn: return, new phrase, moving the coins

Ledger officially recommends swapping the device only to buyers from CryptoBilis. For devices from German retail there is no recommendation from the manufacturer yet. These steps serve as orientation for anyone who wants to be on the safe side:

1. Device still shrink-wrapped or not set up: do not set it up. Ask the retailer whether it will take the device back, and contact official Ledger support. Devices bought online can usually be returned within 14 days.
2. Device set up, bought at MediaMarkt or Saturn: the safest solution is a new device straight from the manufacturer, a freshly generated recovery phrase and moving all coins onto it. Important: restoring the old phrase on a new device is no protection. Once it has been read out, the attacker knows it.
3. Device bought directly from Ledger: as things stand today there is no confirmed case from direct sales. Following the situation is enough here.
4. In every case: never enter your 24 words anywhere, neither on a website nor in a form nor over the phone. Ledger never calls unprompted, sends no direct messages and never asks for the recovery phrase.

Fraudsters exploit situations like this deliberately. Fake Ledger pages turned up in Google search as early as October 11. How to spot them is in our guide to spotting a fake Ledger website in Google. We advise non-experts against unscrewing the device: the warranty can lapse in the process, and without a reference image an implant is hard to tell apart from genuine components.

Buying a hardware wallet directly from the manufacturer: what it achieves

The case shows that every additional stop between factory and customer is a risk. A purchase in the manufacturer's own shop shortens the route to the minimum. That holds for Ledger as much as for Trezor, Tangem or OneKey. Which devices exist, how they handle recovery and what they cost is shown in our comparison of hardware wallets. Our experience with the best-selling entry-level model is summarised in our test of the Ledger Nano S Plus.

A second protection is splitting up: larger amounts can be spread across several wallets, and anyone using a multisig setup needs several devices for a payout. A single tampered device then cannot give everything away.

Ledger sales halt: what to take away

The sales halt at MediaMarkt and Saturn is a precaution, not evidence of thefts in Germany. Losses are confirmed so far only for devices from Southeast Asia. What is also clear: an implant that passes the authenticity check makes the route of purchase the most important security question. Buy a hardware wallet and you are best served buying it directly from the manufacturer, setting it up yourself and keeping the 24 words to yourself. We will update this article as soon as Ledger or MediaMarktSaturn provide new information.