Somebody soldered a cellular modem into a device that people bought specifically so nothing could leave it. Not a hacker. Not a remote attack. A middleman with a soldering iron.
On Tuesday, MediaMarktSaturn — the parent company of MediaMarkt, one of the largest consumer electronics chains in Europe — pulled Ledger hardware wallets out of its stores and off its online shops. Not in one country. Everywhere it operates. A spokesperson told Cointelegraph the products were “removed from our product lineup internationally in all of our countries” and called it “a precautionary measure.”
Read that again. A retailer with shelves across Europe decided your cold storage was too hot to sell before the company whose name is on the box would tell you how many boxes were tampered with.
Quick Summary
- MediaMarktSaturn removed Ledger products from its physical stores and online platforms internationally, calling it a precautionary measure.
- A customer in Germany, posting as “Johannes”, said he bought two Ledger wallets from two separate MediaMarkt stores — and both contained unauthorized cables and cellular modules.
- Ledger says the implants transmitted users’ recovery phrases over cellular networks, and that it is investigating reports beyond the Malaysian reseller CryptoBilis.
- Blockchain investigator Specter estimates $86 million has been drained from affected devices. Ledger says it has confirmed exactly one unauthorized implant and has not verified the figures circulating online.
- Trezor, Ledger’s biggest competitor, is now cutting the number of resellers it works with and auditing the ones that remain.
What Happened
Ledger first admitted something was wrong on Friday. Customers in Southeast Asia reported funds missing after buying devices from CryptoBilis, a Malaysia-based reseller. By Tuesday, Ledger had confirmed the mechanism: the devices contained an unauthorized hardware implant that read a user’s seed phrase as it appeared on the screen — and transmitted it out over cellular networks. Your 24 words did not get phished. They walked out of the room as a text message.
CryptoBilis has stopped selling devices. Ledger has told customers who bought there not to set up their wallets at all, and to contact support.
Then it got bigger. On Monday, a German customer posting as “Johannes” said he had bought two Ledger wallets from two separate MediaMarkt stores. Both, he said, contained unauthorized cables and cellular modules. MediaMarktSaturn’s response was not a press release — it was an empty shelf. The products came off the website and out of the stores across all of its countries.
Ledger says MediaMarktSaturn suspended sales “in coordination” with the company, that no funds were lost in the German case, and that it has no indication its own infrastructure, systems or services were compromised. It says only devices sold through CryptoBilis have been linked to lost funds — and that it has confirmed exactly one unauthorized implant.
One. The blockchain investigator Specter puts the drained total at $86 million. Ledger’s answer to that number: “We have not confirmed the total number of affected users or the total value lost. Figures circulating online come from third parties and Ledger has not fully verified them.”
And then there is the detail that deserves its own paragraph. Mark Karpelès — the former CEO of Mt. Gox, the exchange that lost 850,000 bitcoin in 2014 — said on Tuesday that a Ledger Flex he bought at Singapore’s airport contained a spy implant. Ledger’s response was to point users back at its CryptoBilis update. It did not directly address the Singapore device.
Meanwhile Trezor, Ledger’s biggest competitor, announced it is reducing the number of resellers it works with and checking the vendors that stay. “There is not a single piece of evidence that Trezor devices have been compromised,” the company wrote. “This is a preventive step, taken out of an abundance of caution.”
So two of the largest hardware wallet makers on earth are now treating the reseller channel itself as a threat surface. Remember July, when hackers took close to $120 million in bitcoin from Coldcard users through a firmware bug that broke seed generation. That was a software flaw. This is older and dumber: a person, a box, and a soldering iron.
Why This Matters for Bitcoin
For a decade the hardware wallet pitch has been simple: your keys never touch the internet, so your coins are safe. That pitch was always incomplete, and this month it broke in public.
The device in your hand is not a cryptographic object. It is a physical product that passed through a factory, a distributor, a warehouse, a retailer, a courier and a shelf. Every one of those hands is a chance for somebody to add hardware you did not ask for. The implant did not break Ledger’s cryptography. It did not break Bitcoin. It sat between your screen and your eyes and copied what you read.
That is the part the industry does not like saying out loud: self-custody does not begin when you buy a device. It begins when you can verify what that device is.
And look at the order of events. The retailer pulled the product before the manufacturer published numbers. A shop in Europe decided its customers were at risk before the company whose brand is on the box would confirm how many boxes had been tampered with. When the middleman moves faster than the manufacturer, the manufacturer has a communications problem that is worse than the technical one.
The Love Is Bitcoin Takeaway
Buying Bitcoin on an exchange is a promise. Buying a hardware wallet from a marketplace is also a promise — the promise that the thing in the box is the thing on the website. One of those promises just got broken in eleven countries at once.
Nothing about this story weakens the argument for holding your own keys. It sharpens it. The entire reason to hold your own keys is that you stop depending on other people’s honesty. So stop depending on other people’s packaging, too.
If you already own a hardware wallet bought from a reseller, a marketplace, or a shop you cannot personally vouch for, the right response is not panic — and it is not buying a new one off the same shelf. It is a new seed, generated on a device you can verify, with the old wallet treated as burned. If you are not certain the device is clean, move the coins. Assume the seed is known.
And if you want to be honest about what actually survives this class of attack: it is not one device from one shop. It is a multisig where the keys come from different vendors, different supply chains, different failure modes. One tampered box then buys an attacker nothing.
This is not a new idea. We have been writing about this exact failure for a week — the hidden board that watched 24 words walk out, and the moment Ledger told 90 days of buyers not to turn their devices on. The lesson did not change. It just got a retailer’s name attached to it.
What Beginners Should Do Next
- Buy direct from the manufacturer. Not a marketplace, not a reseller, not an airport kiosk, not a big-box shelf. The few euros you save are not worth the attack surface.
- Check the box like it is evidence. Tamper-evident seals, matching serial numbers, firmware version on first boot, and a device that asks you to set the PIN instead of arriving with one already configured.
- Generate your own entropy where the device allows it. Dice, cards, or a seed created offline. A device that hands you a seed has already decided where that seed came from.
- Never let a seed appear on a screen you did not verify. The entire point of this implant is that the phrase was displayed and copied.
- If you bought from a reseller, move the coins now. Treat the device as a decoy.
- Learn what multisig is before you need it, not after.
FAQ
Can a hardware wallet be tampered with before you buy it?
Yes. That is exactly what happened here. The device is a physical product that passes through many hands, and an implant can be added between the factory and the shelf.
Did Ledger get hacked?
Ledger says there is no indication its own infrastructure, systems or services were compromised, and that only devices sold through one reseller have been linked to lost funds. The tampering appears to have happened in the physical supply chain.
Is it safe to buy a hardware wallet from a reseller or marketplace?
Buying direct from the manufacturer removes an entire layer of risk. If you do buy from a reseller, verify the device, generate a fresh seed, and be ready to treat the old one as burned.
How much bitcoin was stolen?
Ledger has not confirmed a total. Blockchain investigator Specter estimates $86 million was drained from affected devices. Ledger says third-party figures have not been fully verified.
Does this mean self-custody does not work?
No. It means self-custody has a step people skip: verifying the device that holds the keys. Custody you never verify is custody you quietly outsourced to a box.
What is a seed phrase, and why does the implant want it?
Your seed phrase is the master key to every address in your wallet. Anyone who reads it can rebuild your wallet on their own device and spend your bitcoin. The implant read the phrase as it was displayed.
Should I stop using hardware wallets?
No. Use one — but buy it direct, verify it, and consider multisig so no single tampered device can drain you.
Is this financial advice?
No. It is education.
Final Thoughts
The hardware wallet was supposed to be the end of trusting people. What this month actually proved is that “not your keys, not your coins” was only half a sentence. The other half is: whose hands touched the box your keys were born in?
MediaMarkt pulled the product before Ledger would say how many devices were compromised. Trezor is now auditing the resellers it spent years signing up. Two competitors, one conclusion — the weakest link in Bitcoin self-custody in 2026 was never the math. It was the packaging.
Get your next wallet straight from the people who built it. Coupon LOVEISBITCOIN — buy direct, verify the box, hold your own keys: https://loveisbitcoin.com/bull
So here is the question: if the shop pulled the product before the manufacturer would tell you how many were tampered with, who exactly were you trusting your 24 words to?
Sources: Cointelegraph — MediaMarkt Parent Pulls Ledger Wallets Amid Tampering Reports (Helen Partz, Oct 13 2026); Bitcoin Magazine — Trezor Reduces Number of Resellers Following Ledger Incident (Oct 13 2026). This article is for education only and is not financial advice.
THEY SOLD YOU A 'COLD' WALLET WITH A CELLULAR MODEM INSIDE — MEDIAMARKT JUST PULLED EVERY LEDGER OFF THE SHELF WHILE LEDGER CONFIRMS ONE CASE AND $86 MILLION IS GONE
