Ledger has confirmed that hardware wallet units sold by CryptoBilis contain a hardware implant designed to steal recovery phrases. The confirmation came after an investigation into the affected devices, and MediaMarkt has now suspended sales of the compromised Ledger units across Europe.
The implant is a physical modification, not a firmware bug. That distinction matters because it means the usual software update can't fix it. Once a recovery phrase is exposed, the wallet is compromised permanently.
What the implant actually does
According to Ledger's confirmation, the implant targets the recovery phrase — the 12 or 24 words that control access to a wallet. If you've entered your phrase on one of these units, the seed should be considered burned. The device itself may look and behave normally, which is exactly why this is dangerous.
CryptoBilis sold the affected units as a third-party retailer. Ledger hasn't said how many devices are in circulation or which specific batches are impacted. The company also hasn't detailed how the implant was inserted into the supply chain. MediaMarkt's decision to pull the stock suggests the problem isn't limited to a single batch or region.
MediaMarkt's move and what it signals
MediaMarkt suspended sales in Europe after Ledger's confirmation. The retailer hasn't commented on whether it will offer refunds or replacements, and it's not clear if other European retailers are following suit. For now, MediaMarkt is the only named retailer to act.
The timing isn't great for Ledger. Hardware wallets are supposed to be the safe option — the thing you buy precisely because you don't trust exchanges or online storage. A supply-chain compromise undercuts that pitch directly, and it's harder to explain away than a software vulnerability.
What users should do right now
If you bought a Ledger through CryptoBilis, stop using it. Don't enter your recovery phrase on it. If you already did, move your funds to a new wallet with a freshly generated seed phrase as soon as possible. Ledger hasn't published a full list of affected serial numbers or batch codes, so there's no way to check a specific unit yet.
The company hasn't said whether it will replace affected devices or how it plans to handle the supply-chain failure. CryptoBilis hasn't issued a public statement. MediaMarkt's suspension is the only concrete action taken by a retailer so far.
The unanswered questions
Three things remain unclear. First, how the implant got into the supply chain in the first place. Second, how many devices are affected. Third, whether other retailers sold the same compromised stock. Ledger's confirmation answers the what, but not the how or the how many.
For now, the practical advice is simple: if your Ledger came from CryptoBilis, treat it as compromised. The next concrete step will be Ledger publishing affected batch numbers or a replacement program. Until that happens, users are stuck guessing.
