MediaMarktSaturn has removed Ledger hardware-wallet products from its stores and online platforms as reports of tampered devices widen beyond the Southeast Asian reseller at the center of Ledger’s confirmed investigation.
A MediaMarktSaturn spokesperson told Cointelegraph that the European electronics retail group had removed all of the manufacturer’s products from its physical and online channels, was in contact with Ledger and was treating the incident seriously. The action is a material distribution response, but it is not evidence that every removed device was compromised.
The retailer acted after a social-media user claimed that two Ledger wallets bought from separate MediaMarkt stores contained unauthorized cables and cellular modules. That claim has not been independently confirmed. Cointelegraph said Ledger did not respond before publication to a question about whether it had verified any tampered devices in Europe.
Retail action broadens the supply-chain response
Ledger’s verified findings so far concern a device sold through CryptoBilis, a reseller serving Southeast Asia. The wallet maker said an unauthorized component in that device captured a user’s recovery phrase from the screen during setup and transmitted it over an LTE connection. Ledger has said the implant did not alter its secure element, operating system or transaction signatures.
The MediaMarktSaturn withdrawal therefore represents a precautionary channel-control decision rather than confirmation that the same attack reached the retailer’s inventory. It also goes beyond CryptoBilis, which matters for wallet providers and payment businesses that rely on hardware signing devices: the immediate control question is no longer limited to one seller’s customer list, but includes how distributors isolate stock and establish custody from manufacturer to point of sale.
Cointelegraph also reported that former Mt. Gox CEO Mark Karpelès said a Ledger Flex purchased at Singapore’s airport contained a spy implant. Ledger referred users to its CryptoBilis investigation update when responding, according to the report, without directly confirming that case.
Removal is not the same as a recall
MediaMarktSaturn’s action should not be described as a manufacturer recall. No public evidence reviewed for this article establishes how many products the retailer removed, whether forensic testing found a compromised unit in its stock, or whether customers who previously bought Ledger devices there are included in a formal remediation program.
Those distinctions are operationally important. A temporary sales suspension can prevent additional exposure while a retailer and manufacturer reconcile serial numbers, suppliers and inventory movements. A recall would normally add a defined customer population, affected products and return or replacement instructions. Neither MediaMarktSaturn nor Ledger had disclosed those details in the material available at the time of review.
For wallet vendors, exchanges and payment companies that distribute or depend on signing hardware, the developing incident highlights controls outside the cryptographic core of a device. Tamper-evident packaging, approved-reseller governance, inventory chain-of-custody records and forensic sampling can all become relevant when an attacker modifies hardware before it reaches a user.
Customers should rely on direct instructions from the retailer and manufacturer rather than assume that a sales withdrawal proves their device is compromised. The central verified development is narrower: MediaMarktSaturn has stopped offering Ledger products while it engages with the manufacturer, and Ledger has not publicly confirmed a European compromise.