Ledger wallet spyware forces German reseller to halt sales
German reseller MediaMarkt pulls Ledger wallets after reports of spyware that enabled an $86M draining incident, prompting a review of supply-chain security.
Ledger wallet spyware forces German reseller to halt sales
MediaMarkt, the official European reseller of Ledger, stopped selling Ledger wallets on October 13, 2026, after reports that some devices may have been fitted with physical spyware that enabled an $86 million draining incident. The retailer announced that it had removed all manufacturer products from its stores and online platforms and is in contact with Ledger.
The draining incident and its origins
Last week, wallets bought from the Malaysian reseller CryptoBilis were drained of millions of dollars. Former Mt. Gox CEO Mark Karpelès has been involved in identifying spyware in Ledger wallets that have been dismantled, photographed, and shared on X by their owners. Karpelès reported finding spyware in devices sold by MediaMarkt, Philippine reseller LazMall, CryptoBilis, and a wallet sold at Metapod in Singapore’s airport.
Ledger’s response
Ledger’s latest statement confirms that only wallets sold by CryptoBilis were involved in the draining incident. The company said it has not verified a drain linked to a signer bought elsewhere and is reviewing reports of implants in other signers and locations. Ledger’s security team has deduced that the spyware could record a wallet’s 24-word recovery phrase and transmit it with an attached eSIM. The company noted that CryptoBilis has halted sales while the investigation continues.
Market implications for resellers
The incident places a spotlight on the role of resellers in ensuring device integrity. MediaMarkt’s decision to pull products signals a shift toward tighter control over the supply chain. Other resellers, such as LazMall and Metapod, may face increased scrutiny from both regulators and consumers. The incident could prompt the European Union to tighten certification requirements for hardware wallets, potentially increasing compliance costs for retailers.
Operational consequences for Ledger
Ledger’s investigation into tampered devices may delay the release of new models and could lead to a temporary reduction in sales volume. The company’s decision to halt sales from CryptoBilis suggests that it may impose stricter vetting of third-party suppliers. If the spyware issue proves widespread, Ledger might need to redesign its hardware to mitigate eSIM-based exfiltration.
Consumer risk and response
Users who purchased Ledger wallets from the implicated resellers should verify the integrity of their devices. Ledger has issued guidance on identifying physical tampering and recommends contacting support if suspicious hardware is detected. The incident underscores the importance of sourcing devices from verified channels and maintaining awareness of supply-chain vulnerabilities.
Regulatory and industry reaction
While no regulatory action has been announced yet, the European Securities and Markets Authority (ESMA) has expressed concern over the incident. The European Commission may consider updating the Digital Finance Package to include stricter controls on hardware wallet distribution. The incident may also influence the U.S. Securities and Exchange Commission’s approach to crypto-asset custody.
What to watch next
Ledger is expected to release a detailed report on the spyware’s origin and the steps taken to secure future devices. Retailers will likely reassess their supplier agreements and may adopt stricter due-diligence protocols. Investors in Ledger and its resellers should monitor any changes in sales volumes and regulatory filings.
Bottom line
MediaMarkt’s pull of Ledger wallets after spyware reports highlights the fragility of hardware wallet supply chains. Ledger’s confirmation that only CryptoBilis-sold devices were implicated points to a localized breach, but the broader market may experience tighter controls and increased compliance costs for resellers. Consumers must remain vigilant and verify the integrity of their devices to protect against similar attacks.
Related coverage
- How MiniMed Ended Up With 99% of Its Float Sold Short
- MicroStrategy spends $100 million extra to rebuy Bitcoin it sold
- Longview sale General Dynamics: $1 billion divestiture shakes defense stock