Ledger halts German retail sales and Southeast Asia distribution after hardware wallet tampering discovered
Ledger suspended sales in Germany and Southeast Asia after discovering hidden implants in hardware wallets that steal recovery phrases; Trezor tightened its reseller network as a precaution.
Why it matters
The incident exposes supply chain vulnerabilities in hardware wallet distribution and prompted industry-wide reseller network tightening. Ledger's confirmation that its core technology was not compromised but its distribution channel was attacked shifts focus to retail and logistics security.
Where the sources disagree
Total estimated losses from the attack
$86 million
Bitcoin.com News, Bitcoin Magazine
$86 million to $93 million
Bitcoin.com News
up to $93 million across more than 300 wallets
Bankless
Sources cite different loss estimates ranging from $86 million to $93 million, with some noting figures are unverified and Ledger has not confirmed totals
Key facts
Ledger suspended retail sales at MediaMarkt Saturn stores and online in Germany following a reported device implant
Reported by Crypto.News
Ledger suspended authorized reseller sales across Southeast Asia and Hong Kong while investigating compromised devices
Reported by Crypto.News
Criminals installed hidden electronic implants in genuine Ledger devices to capture recovery phrases and transmit them over cellular networks
Reported by Bitcoin.com News
Compromised devices were sold through Malaysia-based reseller CryptoBilis
Reported by Crypto.News
Ledger said no customer funds were lost in the German case and found no evidence its infrastructure was compromised
Reported by Crypto.News
Ledger introduced new reseller security requirements including keeping devices off store shelves and prohibiting resale of returned devices
Reported by Crypto.News
What happened
Ledger suspended hardware wallet sales at MediaMarkt Saturn stores in Germany and across authorized resellers in Southeast Asia and Hong Kong after discovering criminals had installed hidden electronic implants in genuine devices to capture users' 24-word recovery phrases and transmit them over cellular networks. The implants were found in devices sold through Malaysia-based reseller CryptoBilis. Ledger stated its chips, operating systems, and servers were not compromised and that the attack targeted the distribution channel after devices left its control. Trezor announced it would cut selected authorized resellers starting January 1, 2027, citing supply chain security concerns raised by the Ledger investigation, though Trezor found no evidence its own devices were compromised. On-chain researchers estimate losses between $86 million and $93 million across more than 300 wallets, though Ledger has not confirmed the total. Ledger introduced new reseller requirements including keeping devices off store shelves and prohibiting resale of returned devices.
How the story developed
- Update
First reports of funds siphoned from Ledger devices
Customers in Southeast Asia reported losses after buying from CryptoBilis
- Official statement
Ledger confirms hardware implant in CryptoBilis-sold device
Company confirms unauthorized hardware implant found in impacted user's device
- First report
First report by Crypto.News
Ledger suspends retail sales in Germany as wallet implant probe continues
- Update
MediaMarkt Saturn suspends Ledger sales in Germany
Retailer halts sales in physical stores and online with Ledger's agreement
- Official statement
Official statement from Bitcoin.com News
Ledger Spy Implant Scandal Prompts Mediamarkt Sales Freeze
- Official statement
Trezor announces reseller network tightening
CCO Danny Sanders sends letter stating selected partners will lose authorization January 1, 2027
- Official statement
Ledger introduces new reseller security requirements
New rules include keeping devices off shelves and banning resale of returned devices
How coverage built up
Independent sources over time, counted the way the consensus panel counts them: a republication of a wire story does not move the line.
- 13 Oct 2026, 13:35 UTC: Crypto.News — 1 independent source, 1 reports
- 13 Oct 2026, 19:45 UTC: Bitcoin.com News, official — 2 independent sources, 2 reports
- 13 Oct 2026, 20:40 UTC: CryptoSlate — 3 independent sources, 3 reports
- 15 Oct 2026, 13:40 UTC: Bankless — 4 independent sources, 5 reports
- 15 Oct 2026, 15:58 UTC: Bitcoin Magazine — 5 independent sources, 6 reports
Affected entities
Original sources
| Publisher | Report | Role | Published |
|---|---|---|---|
| Bitcoin.com News Company, official | Ledger Spy Implant Scandal Prompts Mediamarkt Sales Freeze | Independent | |
| Crypto.News Crypto media | Ledger suspends retail sales in Germany as wallet implant probe continues | Original | |
| Bankless Crypto media | Ledger Officially Responds to Hardware Wallet Attack | Independent | |
| Bitcoin Magazine Crypto media | Ledger Says Organized Crime Group Spent Millions Targeting Hardware Wallet Users | Independent | |
| CryptoSlate Crypto media | Ledger’s crypto wallet implant scare triggers Trezor reseller crackdown as security fears spread | Independent | |
| Crypto.News Crypto media | Ledger changes wallet sales rules after crypto thefts | Independent |
Related events
Ledger halts reseller sales across seven Asian markets while investigating tampered hardware wallets
Ledger ordered resellers in Indonesia, Singapore, Thailand, Philippines, Vietnam, Malaysia and Hong Kong to stop sales and pull devices after discovering hardware implants that steal recovery phrases.
Deutsche Bank Prepares German Crypto Custody Launch With 2027 Asian Expansion Target
Deutsche Bank plans to launch institutional crypto custody in Germany within weeks, starting with Bitcoin, Ethereum and select stablecoins, before expanding to Asian financial centers in 2027.
Germany's Sparkassen savings banks launch crypto trading through banking app
Germany's Sparkassen savings bank network began offering Bitcoin, Ethereum, XRP, Solana and Polygon trading through its banking app on October 19, starting with five institutions and planning a phased rollout to over 230 interested banks by mid-2027.
Spain approves emergency rent cap decrees as Bitcoin pitched as an alternative to property
Spain's government approved two emergency housing decrees on 29 September capping rent rises until end-2027, while Bitcoin Magazine pressed bitcoin as a store of value against property.
BaFin rejects Futurum Bank MiCA application, leaving bitcoin.de trading suspended
BaFin refused Futurum Bank AG's MiCA application, leaving bitcoin.de without its own licence and pushing operator Bitcoin Group SE towards a regulated-partner model.
CoinShares survey finds affluent investors in seven countries hold crypto and plan to add more
A CoinShares survey of 2,230 affluent investors across seven countries found crypto makes up about 10% of portfolios on average, and most existing holders plan to increase exposure in 2026.