October 13 follow-up: MediaMarktSaturn sales suspension
Ledger said on October 13 that MediaMarktSaturn had stopped selling its devices in stores and online, with Ledger’s agreement, following a report of an implant from one customer in Germany. Ledger said no loss of funds had been reported in that case. Its Donjon security team would examine devices it received, while support reviewed user reports. This is a separate reported case from the confirmed CryptoBilis implant discussed below; the statement is not a completed forensic report on the German device. [5]
The announcement describes a sales-suspension decision, not an independently verified inventory of every branch or website. It does not establish that all devices sold by the retailer were modified. Ledger also said it had no indication of compromise of its infrastructure, systems or services. Those boundaries matter: the earlier October 11 statement about confirmed cases in the October 9 draining incident should not be read as a final assessment of every later report.
If you have questions about a purchase, open Ledger Support yourself through its official site and keep the purchase records. Do not give recovery words to an incoming caller, direct message or “device verification” form. Ledger reiterated that it will not request the 24-word recovery phrase. The October 13 notice did not publish a model or serial-number list that could clear a particular unit; for CryptoBilis purchases, the reseller-specific guidance and new-seed distinction below remain important.
Ledger has confirmed an unauthorized hardware implant in one device tied to the CryptoBilis wallet-draining investigation. In its October 11 update, the company said all confirmed cases in the disclosed October 9 incident involved devices sold through that Southeast Asian reseller. Its instruction to buyers is unusually concrete: leave unused devices uninitialized; if already set up, move to a new seed on a device bought from Ledger. [1]
The important distinction is between a genuine security chip and everything fitted around it. Separate hardware research shows how an added circuit can watch recovery words travel to a wallet’s screen without breaking the chip that generated them. That research helps explain the risk, but does not establish the precise design of the implant found in the CryptoBilis investigation.
One confirmed implant changes the investigation
On October 10, Ledger Support confirmed the implant in an affected user’s device and said CryptoBilis had stopped sales of all hardware-wallet inventory while the investigation continued. The following day, Ledger said its own systems and direct sales channels remained unaffected and it was working with authorities. It also reminded distributors to use authorized supply channels and never restock returned products. [2]
Those statements establish physical tampering in at least one examined device. They do not identify every affected model, prove that every CryptoBilis unit was altered, or establish who installed the hardware. Ledger has not published a final loss total.
The screen can become the leak
Tibane Labs describes two modified Nano X units obtained in September through Japanese resale channels. Its report explicitly says it has not tested a CryptoBilis device and has no evidence connecting its specimens to that reseller. These are a separate investigation into the same class of hardware threat. [3]
In the documented design, an extra circuit taps the display’s SPI connection—the wires carrying the image to the screen. It recognizes the letters of recovery words and can transmit them using its own cellular modem and SIM. A computer infection or a broken cryptographic algorithm is unnecessary for this route.
The most revealing detail is what the newer specimen no longer changes. Earlier versions made room by shrinking the battery. Tibane’s specimen B leaves the original battery in place and occupies space beneath the OLED display, with black coating that blends into the main board. Checking only the battery would miss that difference.
The genuine-device check can still pass in this design because the secure element itself is authentic. The check and the physical supply chain answer different questions: one verifies a trusted chip; the other determines whether someone added a second computer beside it.
The money trail shows why an emptied wallet is still dangerous
In its October 12 update at 14:00 UTC, Bitquery raised its estimate to $102.0 million taken from 324 wallets across six chains, after identifying nine additional TRON wallets drained of 8.8 million USDT on October 9. The earlier October 11 estimate was $93.2 million from 315 wallets. That is the firm’s on-chain count, not a Ledger-confirmed total or a count of individual customers. Transaction records can show transfers and permissions; they cannot establish how each private key escaped. [4]
Its reconstruction found tightly synchronized activity: 25 TRON wallets signed the same approval within three seconds, following small test transactions in the preceding weeks. The report also describes a wallet drained again on October 10: a regular payer sent it 70,000 USDT, and the attacker pulled those funds about ten minutes later using the existing approval.
That second loss makes the practical problem clear. An empty balance does not retire the address, revoke an attacker’s permissions, or make a possibly exposed recovery phrase private again. Sending new money to the same wallet can recreate the loss.
A replacement device needs a new recovery phrase
Ledger’s current advice to CryptoBilis buyers includes a new seed, not simply a replacement device. Restoring the old phrase on new hardware recreates the old keys. If someone else already knows those keys, changing the object in your hand does not remove their access.
Keep unused affected purchases uninitialized, and use Ledger’s official support site for the migration instructions appropriate to your accounts. Tell regular payers to stop sending to exposed addresses. Preserve purchase records, device details and transaction identifiers for support and a report to local law enforcement; none of those records requires disclosing your recovery words.
Ledger says it will never call, send a direct message, or ask for the 24-word phrase. That boundary matters during the investigation: a supposed recovery service or fake Ledger device check can turn concern about a hardware incident into a separate phishing loss.
The case exposes a gap between authentic hardware and trustworthy delivery. Follow the reseller-specific instructions while the investigation develops, and treat a new recovery phrase as a new set of keys—not a cosmetic reset of the old wallet.
References
- Ledger. “72 hour update on reseller CryptoBilis incident.” X, October 11, 2026. Company update.
- Ledger Support. “Situation Update.” X, October 10, 2026. Hardware-implant confirmation.
- Tibane Labs. “Ledger Nano X: the spy implant.” October 2026, accessed October 12, 2026. Specimen examination.
- Gaurav Agarwal. “The Ledger CryptoBilis hack took $102.0M from 324 wallets. One thief had all the keys.” Bitquery, October 9, updated October 12, 2026 at 14:00 UTC; accessed October 12, 2026. On-chain investigation.
- Ledger. “Update on Ledger devices at MediaMarkt Saturn.” X, October 13, 2026, 12:29 UTC; accessed October 15, 2026. Sales-suspension statement and report scope.
