MediaMarktSaturn Retail Group, the parent company of European electronics retailer MediaMarkt, has removed all Ledger hardware wallet products from its physical stores and online platforms. The decision follows reports of tampered devices containing unauthorized internal components. A spokesperson confirmed the removal on Tuesday, stating that the group is in direct contact with the manufacturer and treats the incident with high seriousness.
The action was prompted by claims from an X user identified as Johannes, who alleged that two Ledger wallets purchased from separate MediaMarkt locations contained unauthorized cables and cellular modules. These specific allegations emerged shortly after Ledger announced it was investigating losses linked to devices sold through Southeast Asian reseller CryptoBilis. Ledger stated that implants in those compromised units transmitted users’ recovery phrases over cellular networks.
Ledger’s investigation expanded beyond the initial CryptoBilis reports following these new claims. Separately, former Mt. Gox CEO Mark Karpelès reported that a Ledger Flex device purchased at Singapore’s airport also contained a spy implant. While Ledger referred users to its latest update regarding the CryptoBilis case, it did not directly address the Singapore allegation. Cointelegraph contacted Ledger for confirmation regarding tampered devices in Europe but received no response prior to publication.
This development highlights the critical vulnerability of supply chain integrity in the cryptocurrency security sector. Even when manufacturers like Ledger implement robust software protections, physical tampering at the retail or logistics level can bypass these defenses entirely. The presence of cellular modules designed to exfiltrate recovery phrases represents a sophisticated threat model that targets the fundamental assumption of cold storage: that private keys never touch an online network. By removing products preemptively, MediaMarktSaturn acknowledges that consumer trust relies heavily on the perceived inviolability of the hardware itself, not just the brand reputation.
For the broader market, this incident underscores the operational risks associated with third-party distribution channels. The fact that tampering was reported in both Southeast Asia and Europe suggests potential widespread logistical compromises rather than isolated incidents. Institutional investors and individual holders must now weigh the convenience of purchasing from major retailers against the heightened risk of intercepted shipments. This situation may accelerate demand for direct-from-manufacturer sales or specialized custodial solutions where physical handling protocols are more tightly controlled and auditable.
