Skip to content
Today
Sign in

InvestReports disagree3 publishers2 min readPublished

MediaMarktSaturn pulled the full Ledger range within four days of losses surfacing at another reseller

MediaMarktSaturn removed all Ledger products from its stores and online platforms over tampering reports. The public German evidence is an X user's claim that two wallets held cellular modules. Ledger did not answer Cointelegraph on whether it has confirmed any tampered device in Europe.

The Investor · Invest desk

How we use AISend a correction

Illustration accompanying MediaMarktSaturn pulled the full Ledger range within four days of losses surfacing at another reseller
Generated illustration
CryptoBilis losses surfaced days before the halt Dates of the first CryptoBilis complaints, Ledger's implant confirmation, Bitquery's loss estimate and the MediaMarkt Saturn sales suspension.

October 9, CryptoBilis customers begin reporting missing cryptocurrency. October 10, Ledger confirms the implant. October 12, Bitquery estimates about $102 million in suspected losses across 324 wallets. October 13, Ledger statement says MediaMarkt Saturn suspended Ledger sales.

  1. 2026CryptoBilis customers begin reporting missing cryptocurrency, claim 9
  2. 2026Ledger confirms the implant, claim 9
  3. 2026Bitquery estimates about $102 million in suspected losses, 324 wallets, claim 17
  4. 2026Ledger: MediaMarkt Saturn suspended Ledger sales, claim 1
CryptoBilis losses surfaced days before the halt
DateEventClaim
October 9, 2026CryptoBilis customers begin reporting missing cryptocurrency9
October 10, 2026Ledger confirms the implant9
October 12, 2026Bitquery estimates about $102 million in suspected losses, 324 wallets17
October 13, 2026Ledger: MediaMarkt Saturn suspended Ledger sales1

What happened

  • Ledger said no customer funds were lost in the German case and that it found no evidence its infrastructure, systems or services were compromised.
  • Ledger confirmed an implant in CryptoBilis devices on Oct 10, a day after customers began reporting missing cryptocurrency on Oct 9.
  • On Oct 12 Bitquery estimated suspected losses of about $102 million across 324 wallets, an amount Ledger has not verified.
  • Former Mt. Gox CEO Mark Karpeles said a Ledger Flex bought at Singapore's airport held a spy implant, and Ledger answered by pointing users to its CryptoBilis update.

Why it matters

  • constraint An owner who already set up a CryptoBilis unit cannot repair it by restoring the phrase elsewhere, since Ledger says that does not protect exposed funds. The remedy is a new device and a new phrase.
  • exposure For any third-party buyer, the point of exposure Ledger documented is first setup: the implant read recovery phrases as they were displayed and sent them out over LTE.
  • precedent Other sellers of custody hardware now have a reference point: at most four days from first complaints at one reseller to a full brand removal at another.
  • decision Buyers who planned to get a Ledger at MediaMarktSaturn must wait or switch sellers, with no restart date for sales announced.

Ledger said every fund loss it verified in the CryptoBilis investigation involved devices bought from that reseller, and that it had not confirmed any theft involving signers from other channels [16]. Germany adds a retailer to the story and little else yet: Ledger's statement left out the device model, the store and the method of modification [19], and whether the German report connects to other suspected cases is a question the company has left open [20]. The retailer's spokesperson was more emphatic. "We take this incident very seriously," the spokesperson told Cointelegraph [6].

The dollar figure is a total whose parts we cannot see. Divide the Bitquery estimate by its wallet count and each wallet averages about $315,000 [14]. That average implies either that a few very large holders dominate the total or that the wallet count is loose (the published figures do not settle which).

The implant's design bears on retail risk more than the dollar total does. The component used a separate microcontroller and an eSIM, and it left the Secure Element, the operating system and the transaction signatures unchanged [3]. In our view, a device that signs correctly therefore proves nothing about whether its recovery phrase stayed private.

The pull costs MediaMarktSaturn one brand's sales for as long as Ledger's Donjon team takes to examine the devices it receives [8]. We see three ways that examination ends. Donjon could find an implant in a unit bought at a MediaMarkt store; with the X user known as Johannes claiming two wallets from separate stores [21], that would put the fault upstream of any single outlet and make retail tampering a confirmed risk for third-party buyers. It could find unmodified units, in which case the removal was a precaution. Or it could find modified units it cannot trace to the shelf, and the question stays open.

We think retail tampering remains a hypothesis for buyers outside CryptoBilis, though Ledger itself said it is investigating reports beyond that reseller [11]. A single implant that Donjon finds in a unit bought from a store would prove our view wrong.

What to watch

  • Donjon's findings on devices received from Germany, and whether any unit bought at a MediaMarkt store carries a cellular module.
  • Whether Ledger addresses the Singapore airport Flex claim directly instead of referring users to the CryptoBilis update.
  • Whether Ledger verifies Bitquery's $102 million and 324-wallet estimate, and when it says sales will resume.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence55
Adoption
Insufficient
Hype gap+20
Incentives
Insufficient
Confidence60

Perspective Coverage

3 publishers
Builder
Builder 22%
Operator
Operator 51%
Investor
Investor 27%
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    According to an October 13 statement from Ledger, MediaMarkt Saturn had suspended Ledger hardware wallet sales in physical stores and online, with Ledger's agreement, following a reported device implant involving a customer in Germany.

    ReportedSupportedSource: Ledger statement of October 13, as reported by crypto.news3 sources— create a free account to open themView cited source
  2. [2]

    Ledger's Donjon researchers confirmed that an unauthorized component inside an affected signer could read recovery phrases displayed during device setup and transmit them through an LTE cellular connection.

    ReportedSupportedSource: Ledger Donjon findings, via crypto.news3 sources— create a free account to open themView cited source
  3. [3]

    The implant used a separate microcontroller and an eSIM to capture recovery words without changing the device's Secure Element, operating system or transaction signatures.

    ReportedSupportedSource: Ledger Donjon findings, via crypto.news3 sources— create a free account to open themView cited source

Sources

3 independent publishers whose own reporting we read for this story.

  1. cointelegraph.com

    1 article · October 13, 2026

    MediaMarktSaturn pulls Ledger products amid tampering reports
  2. crypto.news

    1 article · October 13, 2026

    Ledger suspends retail sales in Germany as wallet implant probe continues
  3. cryptobriefing.com

    1 article · October 13, 2026

    MediaMarktSaturn halts Ledger sales amid spyware concerns

Share your take

Let Clarity write the post for you.

Signed-in readers get a short post drafted on this story in the register they choose — narrative, analytical, or a direct position — editable to the last word before it goes anywhere. The share buttons at the top of this story work without an account.

Create a free account to composeSign in

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

Topics

Entities

Loading related stories