MediaMarkt pulled every Ledger wallet from its stores and online shop on October 13. The parent company, MediaMarktSaturn, confirmed the move after a customer reported hidden cellular modules in two Ledgers from separate stores. The MediaMarkt Ledger story just left Southeast Asia.
So, should you check your own Ledger? Yes, today. An extra SIM card, cable or board inside means a thief could already hold your recovery phrase.
I only ever ordered from the original source, the Ledger website. Still, I opened my Ledgers to check. Mine seemed fine. Out of curiosity, I opened my Trezor too, and it was also clean. That was a relief. However, I would not have slept well without looking.
MediaMarktSaturn told Cointelegraph it removed all Ledger products from its stores and online platforms. It also said it is in contact with Ledger and takes the incident very seriously.
The claim comes from an X user called Johannes. He says he bought two Ledger wallets from two different MediaMarkt stores. According to him, both carried unauthorized cables and cellular modules. Reports add that his funds were not moved.
MediaMarkt runs stores across Europe, including Germany, Spain, Italy, Poland, Austria and the Netherlands. Therefore, this is no longer a regional reseller problem. At the time of writing, Ledger had not said whether it confirmed tampered devices in Europe.
How we got here: from CryptoBilis to Europe
On October 9, Ledger told Malaysian reseller CryptoBilis to pause all sales. I covered that warning in my Ledger CryptoBilis post. On-chain investigators put the losses above $86 million, and some estimates run higher. Ledger has not confirmed any of those totals.
The story then moved fast. On October 10, Ledger confirmed that one affected device held an unauthorized hardware implant. Next, I looked at the ownership side in my post on CryptoBilis selling months before the drain.
Since then, the cases keep spreading. Former Mt. Gox CEO Mark Karpelès says a Ledger Flex bought at Singapore’s airport also held a spy implant. Ledger said on Tuesday that the implants sent recovery phrases over cellular networks. It is also investigating reports beyond CryptoBilis.
How the implant reportedly works
Researchers describe a small board hidden behind the screen. It reportedly carries an antenna and a SIM or eSIM. The board reads what the screen shows, including the recovery phrase during setup. Then it sends the words to the attacker over a mobile network.
Because of that, the seed you generate on the device is exposed from the first minute. The attacker can simply wait. Later, he empties the wallet at a moment of his choosing.
Here is the scary part. The Genuine Check can still pass. It verifies the secure chip, not every part around it. Ledger itself acknowledges that limit in its guidance. So a green check on screen proves less than most owners assume.
Why this may be the biggest hardware wallet compromise ever
Nothing like this has hit a major hardware wallet before. The losses are huge, and the attack path keeps widening. First came a Malaysian reseller. Then a European retail chain. Now an airport shop.
In my view, this is probably the biggest hardware wallet compromise in history. A hardware wallet promises that you trust nobody with your keys. Yet that promise breaks once someone touches the box before you do.
Ledger also recommends authorized resellers, including official storefronts on big marketplaces. This week shows why I skip all of them. Therefore, my rule stays the same: buy from the manufacturer’s own website only.
How to check your own Ledger
Doing nothing is the wrong move. Even if you bought direct, a quick check costs you ten minutes. Here is what I suggest.
- Think about where you bought it. Anything from a store, a marketplace or a gift raises the risk.
- Inspect the box and the device. Look for extra cables, a SIM slot, a small chip with an antenna, or padding that does not belong.
- Be careful when opening it. This can void your warranty, and a careless hand can damage the device. Take your time.
- Do not trust the Genuine Check alone. As noted above, it can miss a hidden board.
- Found anything odd? Stop using that device right away.
- Move your funds to a brand-new seed on a device bought direct from the manufacturer. Never reuse the old recovery phrase. My bunker mode guide walks through the move.
- Cannot tell if it is clean? Treat it as compromised and move anyway.
Also watch your inbox. Scammers love news cycles like this one. Fake “Ledger security” emails already target owners, as I showed in my post on a Ledger phishing email. Ledger will never ask for your 24 words.
Already lost funds? Read can stolen crypto be recovered and act fast. The first hours matter most.
Is Ledger still safe to use?
In my earlier post, I argued that the device itself held up well. You can read it in is Ledger wallet safe. This story tests that view. However, the attack targets the supply chain, not the secure chip.
So my answer today is careful. A Ledger bought direct from the maker still looks like the safest route to me. A Ledger from any middleman does not. For larger sums, a multisig wallet means one bad device cannot drain you alone. Finally, bookmark our stay safe page for the full checklist.
Keep This Content Free
Breaking security stories like this one take hours of reading, checking and opening devices. If it helped you, consider signing up through OKX or Bybit. We receive a small commission, and you pay nothing extra.
Final Words
MediaMarkt pulling Ledger wallets is a loud signal. The tampering is physical, and it keeps popping up in new places. I checked my own Ledgers and my Trezor, and you should check yours. Buy direct, create your own seed and move funds fast if anything looks off. I will update this post when Ledger shares more.
FAQ
Why did MediaMarkt pull Ledger wallets?
MediaMarktSaturn removed Ledger products after a customer reported finding unauthorized cables and cellular modules in two wallets from separate stores. The retailer says it is in contact with Ledger.
Are Ledger wallets from MediaMarkt safe?
Nobody can say yet. Ledger has not confirmed tampered devices in Europe. Still, I would not use any Ledger from a retailer until Ledger clears it.
Can the Ledger Genuine Check detect the implant?
Not reliably. The check verifies the secure chip, so a tampered device may still pass. Physical inspection and the purchase source matter more.
How do I check my Ledger for tampering?
Look for extra cables, a SIM slot, a small antenna board or odd padding behind the screen. Opening the device can void the warranty, so move slowly. If you cannot tell, move your funds to a new seed on a device bought direct.
Is Ledger itself hacked?
Nothing so far points to Ledger’s own chip or software. The reports describe tampering on the route to the buyer. Ledger has not confirmed a final cause.
Where should I buy a hardware wallet?
I only buy from the manufacturer’s own website. Retailers, marketplaces and airport shops add handling steps you cannot verify.
Credit: Source link
