Ledger disclosed new details on Oct. 13 about how criminals tampered with its hardware wallets and potentially stole customers' cryptocurrency. The company's investigation uncovered a hidden device designed to steal recovery phrases. Mediamarkt Saturn, a major European electronics retailer, has temporarily stopped selling Ledger devices.
What Ledger says it found
The company's probe turned up a concealed component that captures recovery phrases, the 12- or 24-word backups that control access to a wallet's funds. Ledger hasn't said how many units were affected or where they were sold. It also hasn't given a timeline for when the tampering started or how the altered devices got into circulation.
What's clear is the method: someone interfered with the hardware itself, not just software. That's a distinction that matters for anyone who assumes a factory-sealed box is safe.
Mediamarkt Saturn stops sales
Mediamarkt Saturn pulled Ledger devices from its shelves on a temporary basis. The retailer hasn't said whether the pause is precautionary or tied to specific inventory. It also hasn't set a date for resuming sales.
For a chain that size, the move is a logistical headache. It also puts pressure on Ledger to show its retail partners exactly which units are suspect and which aren't. So far, that accounting hasn't been made public.
Why recovery phrases are the target
Recovery phrases are the master key to a wallet. Whoever has them can move funds without touching the device again. That's why attackers go after them instead of trying to break encryption head-on. A hidden device that logs them is a quiet way in — no phishing email, no fake app, just a compromised piece of hardware.
Ledger's disclosure doesn't say whether any customer funds were actually taken. The word "potentially" is doing a lot of work in that statement. The company says it's still investigating.
The questions still open
Three things stand out. One: where did the tampered devices enter the supply chain — at the factory, in transit, or at a reseller? Two: how many units are involved? Three: what should existing owners do right now?
Ledger hasn't answered any of those publicly. Mediamarkt Saturn's pause suggests the retailer isn't waiting for a full answer either.
The next concrete step is Ledger's own guidance for customers who bought devices through retail channels. Until that lands, the safest read is the one the facts support: a hardware wallet is only as trustworthy as the path it took to your hands.
