European electronics retailer MediaMarktSaturn has removed every Ledger hardware wallet from its stores and online platforms after tampering reports surfaced in Germany and Singapore, widening an investigation Ledger had initially scoped to a single Southeast Asian reseller.

A spokesperson for the MediaMarktSaturn Retail Group confirmed the action in an email to Cointelegraph on Tuesday. "The MediaMarktSaturn Retail Group has removed all of the manufacturer's products from its stores and online platforms and is in contact with the manufacturer," the representative said. "We take this incident very seriously."

What triggered the European pull?

The action follows a Monday post from an X user named Johannes, who said he purchased two Ledger wallets at separate MediaMarkt stores in Germany and discovered both contained unauthorized cables and cellular modules. The wallets were, in his account, designed to transmit sensitive data without the buyer's knowledge.

Ledger disclosed on Friday that it was investigating losses tied to devices sold through CryptoBilis, a reseller in Southeast Asia. By Tuesday, the company had updated its findings: implants in compromised units transmitted users' recovery phrases over cellular networks, allowing an attacker to drain a wallet after the seed phrase was entered.

What does this change for European retailers?

Distribution partners now face a verification problem that did not exist a week ago. Retail staff cannot easily detect a hardware implant sealed inside factory packaging, and a unit-by-unit forensic inspection at the point of sale is not commercially realistic.

The MediaMarktSaturn response — full category removal rather than a recall of specific SKUs — illustrates how distributors are managing that risk in real time. The wider consequence falls on institutional custody desks. Until the manufacturer publishes a way to distinguish compromised units from clean ones, every Ledger wallet currently in distribution carries the same exposure as the devices that triggered the pull.

The cellular transmission method also raises a sharper question: any Ledger device that passed through a non-direct supply channel in the past several months should be treated as suspect until Ledger identifies the manufacturing stage at which the implants were introduced. CryptoBilis and MediaMarktSaturn are the named vectors. The unknown is whether others remain.

How far does the geographic spread extend?

A second case widened the geography on Tuesday. Former Mt. Gox chief executive Mark Karpelès said he had purchased a Ledger Flex at a Singapore airport retail outlet and that the device contained a spy implant. Ledger responded by directing Karpelès to its CryptoBilis update and did not directly address the Singapore incident.

Cointelegraph asked Ledger whether it had verified compromised units in Europe and had received no answer by publication time.

What should practitioners watch next?

Three signals will determine the next phase. First, whether Ledger discloses additional resellers or regions under investigation beyond CryptoBilis. Second, the forensic method used to identify the implants, since the cellular transmission of recovery phrases points to either a factory compromise or a reseller-side interception point. Third, the response from competing hardware wallet vendors now competing for shelf space that was Ledger's a week ago.

The supply-chain assumption for hardware wallets — that a sealed box equals an untampered device — has now broken twice in two weeks. Distributors and institutional buyers who treat hardware wallets as part of custody infrastructure will need to verify, not assume, the provenance of every unit until Ledger publishes a closing report on the CryptoBilis and MediaMarktSaturn cases.