Ledger has confirmed that hardware wallet units sold through reseller CryptoBilis contained an unauthorized physical implant, and European electronics retailer MediaMarkt has suspended sales of the devices as a result.

The French hardware wallet maker verified the tampering in reseller-shipped units, according to the company's own confirmation. The finding concerns devices that passed through CryptoBilis, a third-party reseller, rather than Ledger's direct sales channel. MediaMarkt, one of Europe's largest consumer electronics retailers, responded by pulling Ledger hardware wallets from sale across its European stores.

Details of the incident remain limited at this stage. The confirmation establishes that a physical component was implanted in resold units, but Ledger has not yet published a full technical breakdown of the implant's function, the number of affected devices, or the time window during which the tampered units shipped.

What does this change for buyers?

The immediate consequence is operational. Customers who purchased Ledger devices through reseller channels, rather than directly from Ledger, now face uncertainty about hardware integrity. MediaMarkt's suspension removes one of the few mainstream retail routes for hardware wallets in Europe, at least temporarily.

The incident also revives a long-running tension in hardware wallet distribution: the security model assumes an untampered supply chain, yet resellers sit outside the manufacturer's direct control. Ledger has previously urged customers to verify device authenticity on receipt. A physical implant, however, represents a more serious supply-chain compromise than firmware or packaging concerns, because it can operate below the level of software verification.

For Ledger, the business exposure is twofold. First, retail distribution through chains like MediaMarkt is a meaningful sales channel in Europe. Second, the company's core selling proposition — that its devices are tamper-evident and secure by design — is directly implicated when a reseller channel produces implanted hardware, even if Ledger's own logistics were not the point of compromise.

CryptoBilis, as the reseller in question, now faces the most direct scrutiny. The implant was confirmed in units that passed through its operations. Whether the tampering occurred at the reseller, in transit, or at another point in the chain has not been established in the information disclosed so far.

What comes next?

The open questions are concrete: how many units were affected, whether any implanted hardware was used to capture seed phrases or private keys, and whether other resellers received tampered stock. Ledger's confirmation and MediaMarkt's suspension are the first steps in what will likely be a wider review of reseller-channel security. Until Ledger publishes the affected serial ranges or batch identifiers, buyers who used third-party resellers should treat verification of their device as a priority, and the market will be watching for Ledger's next disclosure.