Ledger tightens retail stock handling after implant investigation

15 October update: new retail handling rules

Ledger’s 15 October response introduces immediate stock-handling requirements for its authorised resellers and distributors. Products should no longer be placed on shelves or displays; stock should remain in the back and be handed over when purchased. The company also requires prompt reporting when a customer describes an unusual product.

The same statement reiterates an existing ban on reselling returned devices, even apparently unopened ones. Ledger says it is working on additional product-level measures, but does not specify them. These changes address handling and escalation within the retail network; the statement does not announce that suspended sales have resumed. The earlier German inspection findings below remain company-reported results, rather than independent clearance of every device.

German stock checks and the reported devices

Ledger said on 14 October 2026 that its security team inspected retail and distributor stock across Germany after reports from one person in the country. The company says those checks included stock from the stores named in the reports and found no signs of tampering. It also says no implant-related loss of funds has been reported anywhere in Europe. These are Ledger’s findings and reporting claims, rather than an independent survey of every device sold.

The devices shown online remain a separate question. Ledger says it has not yet examined them and has invited their owner to send them for analysis. Inspection of other stock therefore does not resolve what happened to those particular units. The update gives no sample count or date for publishing that analysis.

The earlier MediaMarkt Saturn sales halt

The German report had already prompted a retail response. On 13 October, Ledger said MediaMarkt Saturn had stopped selling its devices in stores and online, with Ledger’s agreement, while the investigation continued. That earlier statement concerned an implant report from one German customer and said no loss of funds had been reported. An implant, in this context, means an unauthorised physical addition to the device, rather than simply a change to its software.

Ledger’s earlier notice said it had no indication that its infrastructure, systems or services were compromised. It directed questions about purchased devices to official support and said Donjon would examine hardware received. It also warned that circulating claims and figures remained unverified. For buyers following the investigation, those points separate a precautionary sales decision from a completed forensic conclusion. The company’s support direction did not require disclosing recovery words: the same notice said Ledger would never call, send a direct message or ask for the 24-word recovery phrase.

Authenticating a chip is a narrower test

Ledger Donjon’s documentation explains the scope of Genuine Check, the device authentication process. Its target is the Secure Element, the protected chip that carries the device’s authentication credentials. During manufacturing, the chip creates a pair of cryptographic keys. Ledger’s secure server signs the public key, creating an attestation for identifying the chip later.

When the check runs, the server sends a fresh challenge and the chip signs it using its private key. The server checks both the manufacturing attestation and the response. This tests whether the chip can produce the expected cryptographic proof, rather than judging a device by its packaging or appearance. Donjon describes checks during onboarding, access to the wallet application, app installation and firmware updates.

The documentation explicitly says this process cannot detect a spying implant when the original Secure Element remains intact. A genuine chip and unmodified physical hardware are consequently different questions. This background explains why physical examination matters; it does not independently establish the condition of the devices in Germany.

Physical reference images need the correct model

Ledger’s hardware-integrity guide provides internal reference photographs for different models and circuit-board revisions. A printed circuit board, or PCB, is the board on which the electronic components sit. The Nano X section, for example, distinguishes revisions and shows front and back layouts. Comparing against the correct reference matters because legitimate layouts can differ. The photograph accompanying this article is a Nano X reference image from that guide, not a device examined in the German investigation.

The guide also describes limits to handling the hardware. Damage caused while opening or inspecting a device voids its warranty, and static electricity can permanently damage an exposed board. It specifically discourages owners from disassembling Ledger Stax and says qualified personnel should ideally inspect its interior. Reference pictures therefore do not turn opening any model into a routine home check. They explain what a physical comparison involves, while Ledger’s invitation to examine the reported units remains unresolved.