MediaMarktSaturn Removes Ledger Wallets as Precaution

MediaMarktSaturn has removed Ledger hardware wallets from its stores and websites across the countries where it operates, saying the step is precautionary as reports of tampered devices spread. Ledger said it agreed to the sales suspension after a customer in Germany reported an implant; no loss of funds was reported in that case. The retailer’s action follows confirmed cryptocurrency thefts involving Ledger devices sold through CryptoBilis, a reseller in Southeast Asia. Ledger says every confirmed draining case linked to the incident involved devices sold through that reseller. The company has not verified a fund drain involving a device bought elsewhere, and it has not confirmed the number of affected users or the total losses. Ledger’s security team, Donjon, described how the implant found in an affected device works. According to the team, it reads the 24-word recovery phrase displayed on the device screen during setup and sends it over LTE using an eSIM. Ledger said the implant does not alter the device’s Secure Element, operating system, transactions or signatures. Reports of possible implants beyond CryptoBilis have not been verified by Ledger.