MediaMarkt Completely Removes Ledger Products; Supply Chain Hardware Tampering Spreads Across Europe and the US

European consumer electronics retail giant MediaMarktSaturn Retail Group confirmed on October 13, 2026, that it has completely delisted products from French hardware wallet manufacturer Ledger from its European offline stores and online platforms. This decision follows reports from multiple European users who claimed the devices they purchased contained unauthorized cables and cellular communication modules. As of October 13, 2026, blockchain data platform Bitquery tracking confirms that this physical tampering attack, spanning distribution channels across multiple countries, has drained 324 victim wallets across six public chains, with a cumulative on-chain theft total of $102 million.

From Southeast Asian Distributors to European Stores: How Did Hardware Tampering Spread Across Borders?

This delisting marks the spread of the crypto hardware supply chain tampering incident from Southeast Asia to Europe.

On October 9, 2026, Ledger disclosed abnormal asset depletion in devices sold by its authorized distributor CryptoBilis and suspended all shipments. According to reporting by Malaysian media outlet Fintech News Malaysia, CryptoBilis' former founder completed an equity transfer and exited operations in March 2026; the entity had long been responsible for distributing devices across Indonesia, Malaysia, and the Philippines.

Physical tampering was subsequently confirmed at more offline outlets. On October 12, 2026, former Mt. Gox CEO Mark Karpelès publicly stated that his Ledger Flex wallet, purchased at a Metapod store in Singapore Changi Airport, also had spy chips implanted. Shortly after, European user Johannes exposed that devices bought from two German MediaMarkt stores both contained abnormally soldered cables and cellular modules capable of bypassing security chips to transmit private keys outward during mnemonic phrase generation. A MediaMarktSaturn spokesperson confirmed to Cointelegraph on October 13, 2026 that the group has delisted all Ledger hardware and is verifying investigation details with the manufacturer.

$102 Million in On-Chain Losses: How Are Attackers Laundering Stolen Assets?

Cybersecurity media outlet The Hacker News reported that Ledger has already confirmed the presence of hardware implants in victim devices within its investigation announcement. From September 25 to October 7, 2026, hackers launched 41 small-amount authorization withdrawal tests on TRON and Ethereum, coordinating 324 wallets to hand over control and transfer assets in concentrated bursts within minutes on October 9.

Calculations based on Bitquery on-chain data by TechFlow reveal that among the stolen $102 million, the TRON network bore the largest losses, with 140 wallets drained of $79.3 million, accounting for 77.75% of the total; the Bitcoin network was emptied of 203.8 BTC worth $16.8 million (16.47%); Ethereum suffered a loss of $3.68 million, while the remaining three public chains (BNB Chain, Polygon, Solana) combined for $2.28 million in losses. Following the incident, Tether froze $10 million in USDT across 20 implicated TRON addresses, but TechFlow estimates indicate this freeze only intercepted 12.61% of the total stolen assets on the TRON chain. Hackers quickly swapped the remaining $23.7 million into USDD, then exchanged them via THORChain for 9,847 ETH, injecting at least 6,680 ETH into Tornado Cash and Zcash to complete the laundering.
TechFlow's analysis of funding timelines for victim addresses reveals a significant temporal loophole in the official recommendation to "inspect devices used within the past 90 days." 40% of victim wallets recorded their first deposits prior to the 90-day safety threshold; alone, 42 TRON victim addresses funded in June 2026 account for 30.0% of that chain's victims. This on-chain distribution data corroborates that physical tampering occurred at least one month earlier than the investigation window recommended by officials.

The security assumption of hardware wallets rests on the premise that the physical supply chain cannot be tampered with. As the attack surface descends into offline distribution channels and physical chip implantation, the trust chain of cold storage faces fundamental breakdown. As of October 13, 2026, $2.38 million in USDC remains untransferred within hacker-controlled addresses, Circle has not yet issued a blacklist freeze order, and cross-border judicial evidence collection concerning CryptoBilis and the European retail segment is still underway.

Join the official Coincamps community:

X: https://x.com/coincamps

Telegram: https://t.me/coin_camps