Ledger Reveals Recovery-Phrase Implant as MediaMarktSaturn Pauses Sales

Ledger said Tuesday that attackers installed hidden hardware implants in some wallets sold through Southeast Asian reseller CryptoBilis, potentially exposing users’ 24-word recovery phrases and prompting a temporary European sales freeze.

The implant could detect the phrase during device setup, decode it and transmit it over LTE through a provisioned eSIM. Ledger said the component was separate from the wallet’s Secure Element and did not alter its operating system, transactions or signatures.

MediaMarktSaturn, a major European electronics retailer, suspended Ledger sales in stores and online on Oct. 13 after a customer in Germany reported finding an implant in a device. No loss of funds was reported in that case.

Ledger said all confirmed losses linked to the incident disclosed Oct. 9 involved devices sold through CryptoBilis, which appeared in Ledger’s authorized reseller directory. The company has not confirmed how many users were affected or the total value of stolen cryptocurrency.

Estimates circulating online have risen from $86 million to $93 million, but Ledger said those figures have not been fully verified. The incident puts renewed focus on hardware-wallet distribution, including devices sold through authorized channels.