Ledger wallet sales have been suspended at MediaMarktSaturn stores and online in Germany after a customer reported a suspected hardware implant. Ledger agreed to the sales pause while investigators examine the device. No customer losses have been reported in the German case.
Table of Contents
Ledger announced the decision on October 13. The company said its systems, services, and infrastructure showed no signs of compromise. It has not disclosed when retail sales could resume or how many devices require examination.
The Ledger wallet maker has asked concerned buyers to contact official support. Its Donjon security team will inspect submitted devices, while support staff review customer reports. The findings have not yet established how the German device was altered.
Why Were Ledger Wallet Sales Suspended?
The reported implant cast doubt on hardware being purchased via third-party resellers. Ledger has yet to determine which model, place of purchase, and method of potential tampering were involved. The connection of the incident to any other incidents elsewhere is not yet determined either.
Also Read: Morgan Stanley Delays Tokenized Stock Trading to 2027 Amid Weak Demand
MediaMarktSaturn has stopped selling Ledger wallets both online and at their retail locations by mutual agreement. The suspension is still in effect pending the investigation.
Ledger stated that their investigators will release further information upon review of the evidence. They have also advised against assuming anything not verified and released as official information from online sources. No theft of customer cryptocurrency has been tied to the reported incident in Germany.
What Did Ledger Find in CryptoBilis Devices?
Another investigation into Ledger wallets was launched following reports of missing funds by CryptoBilis, a Southeast Asian reseller, on October 9. Ledger analyzed the affected hardware and discovered an unauthorized implant on October 10. Afterward, CryptoBilis suspended device sales during the investigation.
Donjon researchers published their technical analysis on October 13, where they identified an embedded microcontroller in the modified signer. This component was capable of reading the recovery words during initialization of the hardware. Using eSIM and LTE connectivity, it would transmit this data beyond the hardware.
The implant was able to function without changes in Secure Element, operating system, or transaction signatures. Rather, it was focused on the phrase controlling the wallet funds.
Ledger confirmed that all losses in the CryptoBilis investigation were based on hardware purchased through this reseller. The company had not confirmed any other theft from devices purchased via other distributors. The company has not connected the findings to the German Ledger wallet case.
How Large Are the Reported Losses?
The analytics firm Bitquery has estimated losses of about $102 million from 324 wallets. This is based on its findings released on October 12 that involved six different blockchain networks. However, these are only estimates and do not necessarily reflect any Ledger loss.
Ledger has not validated the total number of victims or all the transactions involving compromised hardware. The German investigation into the Ledger wallet does not involve any losses of funds. The two incidents, therefore, can be distinguished by the company.
How Can Ledger Wallet Owners Stay Safe?
Users with unused devices should refrain from initializing them, according to Ledger. People with already initialized and possibly compromised hardware devices were recommended to transfer their funds to a trusted device with a fresh recovery phrase. Even after restoring the compromised phrase on another wallet, the funds would be vulnerable to hackers.
In addition, on October 11, researchers uncovered fake Ledger webpages within the Google search results, where some of them were pointing users to malicious wallet apps instead of legitimate ones. This information was concerning phishing efforts but not hardware implants.
Previously, Zscaler, the cybersecurity company, had revealed malicious advertisements by Google in September, leading the users to fake Ledger wallet verification pages to steal their recovery phrases, which were sent to a domain controlled by attackers.
Phishing campaigns are not related to any of the hardware vulnerabilities. According to Ledger, its employees do not ever request customers’ 24-word recovery phrases. Users interested in receiving updates should contact Ledger and MediaMarktSaturn support officially.
Also Read: Meta Muse Wonder Oct 13: Powerful 2 Models on 3 Channels
