German Retailer Stops Ledger Sales After $86M Crypto Theft Scandal
MediaMarkt halts Ledger wallet sales following a major theft exploiting compromised devices.
MediaMarkt halts Ledger wallet sales following a major theft exploiting compromised devices. This is an original TLT brief synthesising 2 outlets (Protos, Decrypt), with their figures cross-checked, plus live market data, as of Tue, 13 Oct 2026 15:15:01 UTC.
This incident highlights critical vulnerabilities in hardware wallet supply chains and raises concerns about user security in the crypto ecosystem. The theft, facilitated by tampered devices, underscores the need for enhanced security measures in hardware wallet distribution.
- MediaMarkt pauses Ledger wallet sales after $86M theft incident.
- Attack used tampered devices with hidden chips to steal crypto.
- Ledger confirms chips read 24-word recovery phrases during setup.
Multiple outlets, including Protos and Decrypt, confirm that German electronics retailer MediaMarkt has halted sales of Ledger hardware wallets following an $86 million theft. The incident involved tampered devices distributed by Malaysian reseller CryptoBilis, which contained hidden chips designed to steal users' 24-word recovery phrases. While both outlets agree on the core details of the theft and its mechanism, Decrypt provides additional technical insight into how the hidden chips compromised the devices without tampering with the Secure Element or Ledger's software.
MediaMarkt, a major electronics retailer in Germany, has temporarily suspended sales of Ledger hardware wallets after an $86 million crypto theft was linked to compromised devices. The incident, first reported by Protos and corroborated by Decrypt, involved tampered wallets distributed by Malaysian reseller CryptoBilis.
The attack utilized hidden chips embedded in the tampered devices, which were designed to capture users' 24-word recovery phrases during the setup process. According to Decrypt, these chips were sophisticated enough to read the recovery phrases without compromising the Secure Element or altering Ledger's software, making the tampering difficult to detect.
Ledger has acknowledged the issue, confirming that the hidden chips were specifically engineered to steal users' recovery phrases, thereby providing attackers with full access to the compromised wallets. The company is reportedly working with law enforcement to investigate the incident and prevent further breaches.
This incident follows a series of security concerns for Ledger, including previous vulnerabilities that have been exploited by attackers. The theft, one of the largest involving hardware wallets, has raised significant concerns about the security of supply chains in the crypto hardware market.
In the broader market context, the total crypto market cap stands at $2.87 trillion, with 
Bitcoin showing a modest 24-hour gain of 0.43%. The Fear & Greed Index is at 57, indicating a state of 'Greed' among investors. The suspension of Ledger sales by MediaMarkt and the subsequent investigation could impact consumer confidence in hardware wallets and prompt increased scrutiny of supply chain security in the crypto industry.
1 key figure independently matched across 2 outlets reporting this story.
TLT extracts the figures each outlet reports and flags the ones that agree. Numbers cited by only one outlet are attributed in the brief, not shown as corroborated.
German Retailer Stops Ledger Sales After $86M Crypto Theft S — questions & answers
How were the Ledger devices tampered with?
The devices contained hidden chips that captured users' 24-word recovery phrases during setup.
What is MediaMarkt's response to the incident?
MediaMarkt has temporarily halted sales of Ledger wallets following the theft.
How much was stolen in the incident?
The theft amounted to $86 million in crypto.
Which outlets reported this story?
This is an original TLT brief that synthesises reporting from Protos, Decrypt, with the key figures cross-checked for agreement across them. It is not a copy of any one article — follow the source links above for the original reporting.
Original summary — not financial advice. This is an original TLT brief that summarises a development reported elsewhere and adds live market data for context; it is not the original article and reproduces no part of it. Follow the source link above for full details. Crypto is volatile and high-risk — always do your own research.