Ledger Wallets Come Off Shelves at MediaMarkt Saturn and Resellers Across Southeast Asia

Introduction

MediaMarkt Saturn, one of Europe’s largest electronics retailers, announced on October 13 that it is removing Ledger hardware wallets from its shelves and online store. The decision follows a report from a German customer who claimed to have discovered a hardware implant inside a Ledger device. Ledger itself has confirmed that, to date, verified incidents of tampering and fund loss are limited to a handful of users in Southeast Asia, and it has asked distributors in seven Asian markets to pause sales while the investigation continues.

Why the Pull‑Back?

Ledger’s security team, known as Donjon, identified an unauthorized component in at least one device that could capture the recovery phrase during setup and transmit it via a cellular connection. The company says there is no evidence that its own infrastructure or software has been compromised, but the presence of a physical implant raises serious supply‑chain concerns. As a precaution, Ledger coordinated with MediaMarkt Saturn to halt sales in Germany and with regional partners in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong to pull devices from shelves.

The Southeast Asian Focus

The first reports of compromised wallets emerged on October 9 when Ledger asked the Southeast Asian reseller CryptoBilis to pause sales after buyers reported losing funds. Subsequent analysis confirmed that the affected device contained an extra cable and an LTE module—components not part of Ledger’s standard design. Ledger’s statement emphasized that these confirmed drains are confined to Southeast Asia and that no verified loss has been linked to devices sold elsewhere.

Unverified Claims and the German Customer

A day after the retailer’s announcement, an X user identified as Johannes (@0xJohannes_) posted that he had purchased a second Ledger from a different MediaMarkt location and found the same modifications. He alleged that store records traced the inventory to a company called Aqipa GmbH and called for a full recall. Ledger has not verified Johannes’s account, nor has it named Aqipa in any official communication. The company stresses that many online claims remain unverified and that its investigation is ongoing.

What This Means for Users

• Supply‑chain vigilance: The incident highlights the importance of trusted distribution channels. Users should purchase hardware wallets directly from the manufacturer or authorized retailers with clear provenance.
• Device verification: Ledger recommends that owners who suspect tampering send the device to the Donjon team for forensic analysis. The company is also reviewing reports of similar implants in other signers and locations.
• No widespread compromise: As of now, Ledger’s internal systems appear intact, and the only confirmed incidents are tied to the Southeast Asian market. Users with devices purchased elsewhere can remain cautiously optimistic but should stay alert for any unusual behavior.

Looking Ahead

Ledger’s investigation is still in its early stages, and the company has pledged to keep the community updated as new information emerges. The pull‑back by MediaMarkt Saturn and the coordinated pause across Asian markets demonstrate a proactive approach to containing potential damage. For the broader crypto ecosystem, the episode serves as a reminder that even hardware‑based security solutions are vulnerable to physical tampering if supply‑chain controls slip.

--- This article was drafted with the assistance of AI tools and reviewed by Unchained editorial staff for accuracy and clarity.