European electronics giant MediaMarktSaturn has removed Ledger hardware wallets from all physical stores and online platforms internationally as a precautionary measure following a sophisticated supply chain attack. The decision comes as security researchers and former Mt. Gox CEO Mark Karpelès confirm physical spy implants discovered inside Ledger devices purchased at various locations, including a Singapore airport store and European retail outlets.
Ledger's internal security team, the Donjon, detailed the mechanics of the hardware compromise. The physical implant resides inside the device enclosure, reading visible screen data during setup. When the hardware displays the 24-word recovery phrase, the rogue microcontroller decodes the text and transmits the sensitive information over LTE utilizing a pre-provisioned eSIM. Investigators emphasize that the malicious hardware bypasses the core Secure Element and operating system entirely, leaving transaction signatures unaltered while silently siphoning recovery keys.
On-chain analytics firm Bitquery estimates that attackers have drained approximately $102 million across hundreds of wallets spanning six distinct blockchains. Perpetrators attempted to obscure the stolen funds by channeling Ethereum through the Tornado Cash mixer and privacy coin Zcash, though blockchain sleuths successfully mapped the transactional timing and amounts. Meanwhile, stablecoin issuer Tether has frozen roughly $10 million in associated USDT tokens as international investigations expand.
While Ledger maintains that officially confirmed cases primarily trace back to a Southeast Asian reseller named CryptoBilis, the emergence of tainted units in traditional retail channels has prompted broader industry scrutiny. Retailers are halting distribution pending further supply chain audits, and security experts are urging users to carefully inspect device enclosures or follow newly published teardown guides to verify hardware integrity.
Comments