MediaMarktSaturn’s reported removal of Ledger products follows two buyer-reported tampered devices, but neither their implants nor European losses have been confirmed by Ledger. The key risk is that a physical implant could capture a recovery phrase during setup even when the device passes authenticity checks.

MediaMarktSaturn’s reported removal of Ledger products follows two buyer-reported tampered devices, but neither their implants nor European losses have been confirmed by Ledger. The key risk is that a physical implant could capture a recovery phrase during setup even when the device passes authenticity checks.

Cointelegraph reported on October 13 that MediaMarktSaturn removed Ledger products from stores and online while contacting the manufacturer. Its report says a customer reported modified devices at two retail locations, but it does not give a retailer explanation for the removal. Cointelegraph’s report

Buyer 0xJohannes_ says the two devices, bought at different MediaMarkt locations, had extra cables and an LTE module. He says one was sent to Mark Karpelès and the second to Ledger for analysis; he also attributes the stock to distributor Aqipa. These are buyer-reported details, not findings independently confirmed by Ledger or a published analysis. 0xJohannes_’s post

Ledger’s October 13 update says all confirmed fund losses in the disclosed incident involve CryptoBilis devices, it has not verified a drain linked to a device bought elsewhere, and it is reviewing implant reports from other locations. Ledger has not confirmed total affected users or losses. It says its analysis of the CryptoBilis implant found it could decode the 24-word phrase shown during setup and transmit it over LTE, while leaving the Secure Element and operating system unchanged. Ledger’s update

For users, device authenticity and physical integrity are separate questions: a genuine device could still be modified after leaving the factory. Do not enter a recovery phrase into a device you suspect is tampered with; if its phrase was generated or displayed on a confirmed compromised device, follow Ledger’s guidance to move assets to a new signer with a newly generated phrase and contact official support. Ledger’s guidance

The sources do not yet establish who modified the MediaMarkt devices, whether they were capable of stealing phrases, how many such devices exist, or whether any European customer lost funds.

Ledger’s investigation update · Cointelegraph’s report · Ledger Support