German electronics retailer MediaMarktSaturn has pulled Ledger hardware wallets from its stores and online platforms while the wallet maker investigates reports that unauthorized components were found inside some devices. The retailer said it has contacted Ledger and is treating the matter with seriousness.

The move followed claims from a customer who reported that two wallets purchased at separate MediaMarkt locations contained additional cables and cellular modules. Those claims have broadened a security investigation that began with cryptocurrency losses tied to hardware wallets sold by CryptoBilis, a reseller in Southeast Asia. The suspension carries weight beyond Germany: MediaMarktSaturn, which operates the MediaMarkt and Saturn banners, is one of Europe's largest consumer electronics retailers.

Ledger confirmed on October 10 that at least one device connected to the incident contained an unauthorized hardware implant, according to CoinDesk. The company later said all confirmed cases involved devices distributed through CryptoBilis, although it was still investigating additional reports as of October 13.

The concern centers on the initial setup process, during which a hardware wallet displays the user's secret recovery phrase. Hardware wallets keep the private keys controlling cryptocurrency holdings offline, and the recovery phrase is the backup that restores access to those keys. A malicious component could capture that phrase and transmit it over a cellular network, potentially allowing attackers to access the victim's cryptocurrency. However, Ledger has not publicly confirmed that the devices reported in Germany were compromised, nor has it linked them to the Southeast Asian investigation.

Security Probe Widens

On-chain analysts estimate that attackers drained between $86 million and $93 million from more than 300 wallets across several blockchains. Ledger has not confirmed a final loss figure and maintains that its internal systems and direct sales channels remain unaffected.

Ledger is cooperating with authorities and reviewing its reseller controls and hardware protections. The company has also emphasized the importance of purchasing devices through authorized distribution channels and keeping returned products from reentering inventory. The distinction underscores why channel integrity matters: Ledger's assurances cover its direct sales, while devices that pass through resellers depend on controls the company says it is now reviewing.

Ledger advised customers who bought devices through CryptoBilis not to initialize unused wallets. Those who already activated potentially affected devices should transfer their funds to a new recovery phrase generated on a device obtained directly from Ledger. The company also warned users never to share their 24-word recovery phrase with anyone claiming to provide customer support.

Supply-Chain Questions

MediaMarktSaturn's decision is a precautionary response, not proof that compromised devices circulated widely in Europe. Investigators must still establish where the components reported by customers originated, whether additional devices were affected, and how any unauthorized modifications occurred.

That distinction matters for cryptocurrency investors who rely on hardware wallets to protect their digital assets. While Ledger says its internal systems remain secure, the investigation highlights a separate vulnerability: even security-focused devices may face risk when attackers interfere with the physical supply chain. The scenario touches a core assumption of hardware-wallet security — that a device reaching a customer's hands contains only the manufacturer's components. The German sales suspension adds pressure on the manufacturer and the retailer to establish whether the reported incidents represent isolated cases or a broader distribution problem. With Ledger's review of additional reports still open as of October 13, the questions to watch are whether the German customer claims are tied to the confirmed CryptoBilis cases and what investigators determine about the origin of the reported components.