MediaMarktSaturn halts Ledger sales amid spyware concerns

One of Europe’s biggest electronics retailers has stopped selling one of crypto’s best-known security products. MediaMarktSaturn, the parent company of MediaMarkt, suspended sales of all Ledger hardware wallets across 11 countries and more than 1,000 stores as of October 13, 2026.

The trigger was a set of user reports describing unauthorized hardware modifications in Ledger devices bought from its outlets. A device sold to protect your crypto allegedly arrived with extra hardware designed to steal it.

What customers found inside the box

The most alarming report came from a customer in Germany. That buyer described a hardware implant capable of capturing a user’s 24-word recovery phrase and sending it out over LTE.

That combination is about as bad as it gets. A hardware wallet exists largely to keep the recovery phrase offline. An implant that quietly pipes it out over a mobile network defeats the entire point of the product.

The German report prompted an investigation tied to CryptoBilis, a reseller based in Southeast Asia. Ledger’s security team has confirmed that unauthorized implants are present in selected units sold by CryptoBilis.

According to Ledger’s findings, the implants can exfiltrate recovery phrases without changing how the device itself operates. The wallet looks normal and behaves normally while someone else copies the keys.

Following the supply chain

The inventory connected to MediaMarkt’s reported cases was traced back to a distributor, Aqipa GmbH.

The financial picture tied to CryptoBilis is significant. Reported losses from affected CryptoBilis devices are estimated at between $86 million and $102 million, with the damage spread across multiple wallets and chains.

There is an important distinction, though. No fund losses have been reported in connection with devices sold through MediaMarkt. The retailer’s suspension appears to be precautionary rather than a response to confirmed thefts from its own customers.

Ledger has also used the moment to remind users of a basic rule. The company stressed that it never asks customers for their recovery phrases and urged people to stay alert to potential scams.

What this means for buyers and the hardware wallet market

Ledger’s confirmation narrows the problem to selected CryptoBilis units, which is useful. It still leaves buyers needing to check provenance, since a tampered device is designed to look and act like a clean one.

The things to watch now are clear. Will MediaMarktSaturn restore Ledger products, and on what terms? Will investigators tie more units to the CryptoBilis implants or the Aqipa GmbH inventory? And will the estimated $86 million to $102 million in reported CryptoBilis-linked losses grow as more victims come forward?

Until those answers arrive, the most reliable security advice remains unglamorous. Know where your device came from, and never type your recovery phrase anywhere a stranger asks you to.