The hardware-wallet tampering story that began with a Southeast Asian reseller has gone industry-wide. On October 13, rival manufacturer Trezor announced it will shrink its authorized reseller network — affected partners lose their status on January 1, 2027, and shipments to them stop immediately — while MediaMarktSaturn, the European electronics giant behind MediaMarkt, pulled every Ledger product from its physical stores and its websites worldwide.
Trezor's chief commercial officer, Danny Sanders, shared the partner letter on X.
The message was blunt. The hardware, he said, is clean — the partner list is not.
Sanders called the shake-up purely defensive — a way to keep the partner list short enough that every remaining reseller can be properly vetted and audited. Trezor had already dropped CryptoBilis — the reseller at the center of Ledger's investigation — from its own authorized list on October 12.
Hours later, MediaMarktSaturn confirmed it had removed Ledger products from its lineup in all of its countries as a precaution.
The move followed a claim from a customer in Germany who said he bought two Ledger wallets at two separate MediaMarkt stores and found unauthorized cables and cellular modules inside both. Ledger said the suspension was coordinated with the retailer, adding that the German case involved no reported loss of funds.
Why it matters
The incident is no longer a one-reseller problem. It started October 9, when Ledger opened an investigation into losses tied to CryptoBilis, a distributor across Malaysia, Indonesia and the Philippines; it was confirmed when Ledger admitted a device carried an unauthorized hardware implant. The implant works by reading information shown on the device's screen, decoding the 24-word recovery phrase, and transmitting it over cellular networks — without altering the secure chip or the firmware, so the wallet appears to function normally.
The European reports widen the geography. Alongside the German MediaMarkt cases, Mark Karpelès — who once ran the Mt. Gox exchange — said on Tuesday that a Ledger Flex he bought at Singapore's Changi Airport carried a hidden spying component; Ledger pointed to its latest CryptoBilis update instead of addressing that case directly. Ledger said Tuesday it is investigating reports beyond CryptoBilis. On-chain investigators put the suspected CryptoBilis drain anywhere from $72 million to $86 million, with some tallies reaching $93 million — Ledger has confirmed none of those figures.
| Stage | Date | What changed |
|---|---|---|
| Case opened | Oct 9 | Ledger probes CryptoBilis-linked losses |
| Implant confirmed | Oct 11 | Ledger admits unauthorized hardware in a sold device |
| Retailers react | Oct 12 | CryptoBilis off Trezor's list; MediaMarkt customer finds implants |
| Industry response | Oct 13 | Trezor cuts reseller network; MediaMarktSaturn pulls Ledgers globally |
What to watch
- Whether Ledger publishes its full forensic findings, and how many tampered devices turn up outside the CryptoBilis channel.
- If more European retailers follow MediaMarktSaturn — it operates more than 1,000 stores across 11 countries, and any expansion of the pull would deepen the supply-chain reckoning.
- Trezor's January 1, 2027 deadline, and which resellers and markets lose authorization.
- Whether buyers accelerate toward direct-from-manufacturer purchases, which would reshape hardware-wallet economics for resellers.
MarketRadar take
Spot prices are treating this as a supply-chain story, not a crypto story. Bitcoin sits at $83,341 in today's market snapshot, up 0.6% on the day, and Ethereum is flat at $2,508 — neither looks like a market repricing custodial risk at the protocol level. The math supports the calm: even a $93 million drain is a fraction of a percent of daily crypto turnover, and the victims were individual self-custodiers, not exchanges or ETFs. The real exposure sits with the two wallet makers and their distribution chains: Trezor is now preemptively tightening the very channel attackers exploited, and MediaMarkt's global pull signals retailers will not wait for forensics before acting. Expect multisig setups and direct-from-manufacturer buying to gain share in the coming quarters.
