Ledger tampered with in store: MediaMarkt removes devices as a precaution

Achtung, Ledger. This Tuesday, October 13, the European electronics brand MediaMarktSaturn suspended the sale of Ledger in stores and online. The suspension, carried out in agreement with the manufacturer, follows the report of a hardware implant by a German customer. In fact, this decision expands an already heavy case, with approximately 103 million dollars.

The key points of this article:

MediaMarktSaturn has removed Ledger from its stores and online site in all of its countries as a precaution.

Then, the suspension follows the report of an implant by a German customer, a case which currently does not involve any loss of funds.

Thus, Ledger claims to have no indication of a compromise of its infrastructure, and refers each suspicious device to the Dungeon for analysis.

Finally, the implant would read the seed phrase displayed on the screen upon initialization, then transmit it via LTE using an onboard eSIM.

A preventive withdrawal across Europe

The brand does not do things by half measures. To our colleagues at Cointelegraph, a spokesperson for MediaMarktSaturn confirms an international withdrawal:

“The products have been removed from our range in all of our countries. We did this as a precaution. »

In an update published on X, Ledger specifies that it is working “in agreement” with the brand on this suspension. So far, the German case has not resulted in any loss of funds. The manufacturer says it has “no indication” of a compromise of its infrastructure, systems or services.

Because it was this customer, known under the nickname Johannes, who pushed the brand to act. According to his account documented as early as Monday, he purchased two Ledgers in two separate MediaMarkt stores, the second acquisition filmed upon unboxing. Both devices hid the same internal modifications, including additional cables and cellular module. Still according to him, a store employee ruled out the customer return. According to him, the records point to the distributor Aqipa GmbH. Since then, he has called for an immediate product recall. Enough to measure the scale of the brand's gesture, which affects more than 1,000 stores in 11 countries according to the estimate it relayed.

Under the hood, an implant that reads the screen

The mechanics are becoming clearer. According to the technical update relayed by Cointelegraph, the implant is housed in the case and reads the data displayed on the screen. However, upon initialization, the hardware wallet displays the 24-word seed phrase. The microcontroller decodes these words, then sends them over LTE via a pre-installed eSIM. In practice, this separate component does not touch the secure element or the operating system, and does not modify any transactions. Enough to suck up the keys without any signature betraying the maneuver.

For his part, Ledger adds his instructions. The manufacturer is asking buyers on the CryptoBilis channel, the Southeast Asian reseller at the heart of the matter, not to initialize their device. The funds must join a new wallet, with a new recovery phrase. Another rule comes up in each warning. No site, no application, no form should receive your seed phrase. As a reminder, the reseller had changed ownership before the thefts, and has since suspended its own Ledger sales. The manufacturer maintains that the confirmed losses, revealed on October 9, all relate to its distribution channel. The totals circulating online, more than $103 million according to YFarmX compared to $93.2 million at Bitquery, remain third-party estimates that Ledger has not validated.

Finally, Germany does not close the list. Mark Karpelès, the former boss of Mt. Gox, reported Tuesday that a Ledger Flex purchased at Singapore airport also carried a spy implant, according to his message on X. Ledger referred to its last update, without commenting on this specific case.