The CryptoBilis case started as a problem at one reseller in Southeast Asia. Within a week it had reached Europe’s biggest electronics retailer and changed how a rival wallet maker sells its devices. The question buyers now ask is simple: where is it actually safe to buy a hardware wallet?
Two moves on October 13, 2026 defined the answer. MediaMarktSaturn pulled Ledger devices from sale after a customer report of an implant, and Trezor announced it is cutting back its network of authorised dealers.
Key facts
- MediaMarktSaturn suspended sales of Ledger hardware wallets on October 13, 2026; Crypto Briefing reported the halt covers 11 countries and more than 1,000 stores, while other reports describe it as Germany-focused.
- The trigger was a customer in Germany reporting a hardware implant; Ledger said “no loss of funds were reported” from MediaMarkt devices.
- Ledger confirmed unauthorised implants in selected units sold by reseller CryptoBilis; per CoinDesk, the component read the 24-word phrase from the screen and sent it over a mobile network via an eSIM.
- Estimated CryptoBilis losses exceed $90 million across several hundred addresses; Ledger has confirmed no total.
- Trezor told affected dealers on October 13 that “your authorization ends on 1 January 2027”; they get no new stock and may sell remaining inventory until then.
- Trezor says there is “not a single piece of evidence that Trezor devices have been compromised.”
Why did MediaMarkt stop selling Ledger wallets?
MediaMarktSaturn paused Ledger sales as a precaution after a customer in Germany reported a hardware implant in a device bought from its stores. Ledger said the pause followed a single customer report and that no loss of funds had been reported from those devices. Confirmed losses so far are tied to CryptoBilis units sold in Southeast Asia.
According to Crypto Briefing, the German report described an implant that could capture a 24-word recovery phrase and send it out over LTE, and inventory linked to the MediaMarkt cases was traced to distributor Aqipa GmbH. Neither MediaMarkt nor Saturn has published a technical analysis, and no date for resuming sales has been announced.
What makes this attack different
Ledger describes the CryptoBilis case as a physical supply-chain intervention, not a flaw in its software. A tampered device looks and behaves like a clean one; the extra component simply copies what the screen shows during setup. No firmware check catches a radio that was soldered in before the box was sealed.
The wallet looked normal. The shelf it came from wasn’t.
Why is Trezor cutting its authorised dealers?
Trezor is shrinking its reseller network to tighten control over how devices are sourced, stored and handled before they reach buyers. Affected dealers receive no new stock from the date of the letter and may sell remaining inventory until January 1, 2027. Remaining partners move to a revised contract with closer oversight.
The key line of the partner letter, as reported by The Crypto Times: “your authorization ends on 1 January 2027”. Trezor removed CryptoBilis from its dealer list on October 12 as a precaution and says it would review the decision if circumstances change. It has not said how many dealers are affected or in which countries.
On its official help page, Trezor names its own shop as the best source, alongside authorised dealers and its Amazon storefront. Ledger, for its part, now sells its new flagship model only through its own shop.
How do I check a new hardware wallet before using it?
Buy direct from the manufacturer where you can, and inspect before setup: packaging seals intact, no visible differences in weight or housing, no recovery phrase included in the box, and a passed genuineness check in the manufacturer’s app. If anything looks off, don’t initialise the device — contact the manufacturer first.
- Never accept a device with a pre-written or pre-printed recovery phrase.
- Generate the seed on the device yourself, and write it down offline.
- If you bought from a reseller later named in an incident, move funds to a new device with a fresh seed.
Our overview of hardware, paper and metal cold storage covers setup in more detail, and we covered the original CryptoBilis drain in our October 9 report.
What this means for swap users
A swap is only as safe as the wallet that receives it. If you’re migrating to a new device after this week’s news, set it up first, verify the receiving address on the device screen, and send a small test amount before the full balance. On SwapZilla, you can also swap into a coin on a different network during the move; the coins go straight from the provider to your new address, never through a SwapZilla account.
The tracking page shows each step of a swap so you can confirm arrival before wiping the old device. For a deeper look at choosing a device, see our best Bitcoin wallets of 2026.
Final thoughts
Hardware wallets moved the attack surface from software to logistics. This week’s responses — a retailer pause, a dealer cull, a direct-only flagship — are the industry admitting that the box matters as much as the chip inside it.