MediaMarkt Pulls Ledger Wallets After $86M Spyware Drain Hits Multiple Resellers

MediaMarkt stopped selling Ledger wallets. The German retail giant — one of Europe’s biggest electronics chains — pulled the devices from both its physical stores and its online platform after reports surfaced that some units had been physically tampered with, costing buyers roughly $86 million in drained funds.

The company confirmed it’s in direct contact with Ledger over the matter and said it’s taking the situation very seriously. No timeline was given for when, or whether, sales might resume. For now, the shelves are bare and the listings are gone.

Spyware Hidden Inside the Hardware

The technical picture is pretty alarming. Ledger’s own security team found that compromised wallets contained spyware capable of capturing a device’s 24-word recovery phrase — the master key to any crypto wallet — and then transmitting that phrase out via an embedded eSIM. That’s not a software bug. That’s a physical implant. Someone opened these devices, added hardware, resealed them, and put them back into the supply chain.

The first confirmed source of tampered units is CryptoBilis, a Malaysian reseller. Ledger publicly named CryptoBilis as involved in the $86 million drain. But it’s gotten messier since then. Former Mt. Gox CEO Mark Karpelès has been doing his own hands-on work — examining disassembled wallets, reviewing photographs taken by affected owners — and he found spyware in devices that came from more than just CryptoBilis. He identified compromised units sold through MediaMarkt, through LazMall, through a Philippine reseller, and in a wallet bought at Singapore’s airport from a vendor called Metapod.

That’s four separate points of sale. Possibly more.

Ledger, for its part, hasn’t officially linked any reseller other than CryptoBilis to the actual $86 million drain. The company said it hasn’t yet verified similar problems with wallets purchased from other sources. But it is reviewing reports of spyware showing up in devices across multiple regions. So the official position and the on-the-ground findings aren’t exactly matching up right now.

CryptoBilis Pauses Sales, LazMall Silent

CryptoBilis has stopped selling Ledger wallets while the investigation runs. That’s the only reseller besides MediaMarkt confirmed to have halted sales. LazMall hasn’t said anything publicly. Protos reached out to LazMall for comment and got nothing back. Unclear if they’re reviewing their inventory, pulling listings, or just waiting.

More context: Unauthorized Implant in Ledger Devices Drains $86 Million from CryptoBilis Wallets

And that silence is kind of the problem. Hardware wallet security depends almost entirely on the integrity of the supply chain. Once a device leaves the manufacturer and passes through a reseller’s hands, there’s a window — even a small one — where a bad actor with access and the right tools can do exactly what happened here. Open the casing, install a chip or modified component that captures the seed phrase, seal it back up, and let the buyer do the rest of the work by actually loading their crypto onto the compromised device.

It’s a sophisticated attack. Not the kind of thing a random opportunist pulls off. The eSIM transmission method especially points to something planned, not improvised.

Community Alarm and What Ledger Is Doing

Word spread fast on social media. Ledger wallet owners started sharing photos of their disassembled devices, comparing internal components, looking for anything that didn’t belong. Some found it. The posts have been circulating across crypto forums and Twitter threads, and the level of anxiety in those communities is real. People are sitting on hardware wallets they now aren’t sure they can trust.

Ledger’s security team says it’s focused on figuring out the full scope of the problem — how many devices, which batches, which resellers, which regions. The company wants to make sure affected customers know what happened and what to do. But the investigation is still running. No final answers yet.

The situation probably isn’t limited to Southeast Asia, even if that’s where most of the confirmed cases are clustered so far. MediaMarkt operates across Europe, and the fact that Karpelès found tampered units sold through that chain raises questions about how far into Western markets these devices may have traveled.

See also: Spyware Targets Ledger Wallets, Causing $86 Million in Losses Across Europe and South America

There’s also the broader question of what this means for hardware wallet distribution generally. The whole value proposition of a hardware wallet is that it keeps your private keys offline and out of reach. If the device itself is compromised before it ever reaches the buyer, that value proposition falls apart completely. The crypto community has been pushing hardware wallets as the gold standard for self-custody for years. Cases like this one make that recommendation a lot more complicated.

Ledger hasn’t said what it plans to change about how it vets or monitors resellers going forward. No new policies announced. No recall issued for specific serial number ranges. The investigation is ongoing, and the company’s public statements have been careful — confirming CryptoBilis, declining to confirm others, saying it’s still reviewing.

CryptoBilis has paused sales. MediaMarkt has pulled the products. LazMall hasn’t responded to requests for comment.