SOLANA·HUB
DE
Security Developing

MediaMarktSaturn removes Ledger products from its range

MediaMarktSaturn has removed all Ledger products from stores and online platforms. Donjon describes an LTE implant in CryptoBilis devices. Ledger has not verified losses from devices bought elsewhere.

SOLANA·HUB Editorial
Source: Ledger

On 13 October, a spokesperson emailed Cointelegraph. MediaMarktSaturn Retail Group has removed all of the manufacturer’s products from its stores and online platforms and is in contact with the manufacturer. “We take this incident very seriously.”

The implant reads the setup screen

Ledger writes on X that Donjon is investigating signers sold by CryptoBilis, a reseller in Southeast Asia, that contained an unauthorized hardware implant. Ledger confirmed the implant on 10 October for one affected user’s signer.

Every confirmed fund loss tied to the incident disclosed on 9 October involves a signer sold through CryptoBilis. Ledger has not verified a drain linked to a signer bought elsewhere. CryptoBilis has confirmed that it stopped selling Ledger signers while the investigation continues.

The implant sits inside the enclosure and reads what the screen shows. During setup, the signer displays the 24-word recovery phrase. When the implant detects those screens, its microcontroller decodes the words and transmits them over LTE using a provisioned eSIM.

The part is separate. It does not modify the Secure Element or the Ledger operating system, and it does not alter transactions or signatures.

Ledger has not confirmed how many users were affected or the total value lost. The post names no chain and no model, Solana included. Figures circulating online come from third parties, and Ledger has not fully verified them.

CryptoBilis and MediaMarkt

The confirmed finding is CryptoBilis. MediaMarktSaturn’s decision is the retailer’s own statement.

On 12 October, Johannes writes on X about a second device from a different MediaMarkt store, bought that day. He describes extra cables and an LTE module in both devices, and writes that the second device is going to Ledger.

On 13 October he writes that the products are gone from MediaMarkt stores. The spokesperson’s email covers the group’s stores and online platforms.

Ledger says it is reviewing reports of implants in other signers and locations. This post does not confirm devices from MediaMarkt stores.

Cointelegraph asked Ledger whether it had confirmed tampered devices in Europe and had no reply by publication time. Cointelegraph also reports that Mark Karpelès said a Ledger Flex bought at Singapore airport contained a spy implant. Per Cointelegraph, Ledger pointed to the CryptoBilis update.

heise reported on the morning of 13 October, describing eSIM implants and citing an analysis by Tibane Labs. Golem wrote at midday about the 10 October confirmation and the sales stop at CryptoBilis. Both pieces are about that reseller.

Genuine Check and seals

The post links a Ledger guide last updated on 13 May 2026. A Genuine Check runs during setup and whenever the signer connects to My Ledger in Ledger Wallet. It proves a genuine Secure Element.

An implant left in place while that Secure Element stays original falls outside the check. The Donjon threat model states the same limit.

Ledger recommends buying from the official shop or the authorized retail network. The guide discourages unlisted, unknown sellers.

The threat model says classic seals, including holographic ones, are easy to clone. A package can be opened and closed without breaking the seal.

The Genuine Check confirms authenticity there, not the device’s path through the supply chain. The May guide describes a shell that opens only with visible damage for the Nano Gen5.

Ledger Support says a real device never arrives with a pre-written recovery phrase. The 24 words are generated on the device. Ledger Support says not to use a phrase that came in the box.

For CryptoBilis buyers, the post says not to set up a signer that has not been set up. If it has been set up, the assets go to a new signer with a new recovery phrase.

The phrase is not entered or restored on a CryptoBilis signer. It is not entered into a website, an app, or a form.

Someone who did not buy from CryptoBilis and wants to open the signer backs up the phrase first, Ledger writes. Opening can damage the device. The May guide adds that damage from opening voids the warranty.

If funds were lost, Ledger says to speak with law enforcement before opening the signer. It is not sent to anyone before that conversation with Ledger Support or the police.

Ledger will not call, write directly, or ask for the 24 words.

Update (15 October 2026): spot checks and shelves

On 14 October Ledger wrote that checked stock in Germany showed no tampering. On 15 October Ledger added opened spot checks, also clean according to Ledger. The short update covers the shelf rules.

What to watch

  • Whether Ledger confirms a device from a MediaMarkt store
  • Whether a model or a chain is named
  • Whether a verified total and a user count follow
  • Whether MediaMarktSaturn publishes its own statement

Note: This is reporting, not investment advice. It is not an offer to recover lost funds.

Sources

#ledger #mediamarkt #cryptobilis #wallet #dach

Related Articles