Two tampered Ledger wallets have been discovered in Germany at MediaMarkt within 48 hours, found by the same buyer. But Ledger has not, at this stage, formally extended its investigation to Europe nor confirmed a product recall by the retailer: both claims are circulating online, neither is sourced.
🔑 Key Takeaways
- Southeast Asia: between $72M and over $93M stolen per Bitquery (311 wallets drained across 5 blockchains)
- Germany: two tampered Ledger devices bought at MediaMarkt, 48 hours apart, by the same buyer
- No formal withdrawal of Ledger products from MediaMarkt shelves has been announced by the retailer
- Ledger’s Genuine Check does not detect the physical implant added by the attacker
- Recommendation: buy directly from Ledger and migrate funds to a new recovery phrase
Southeast Asia: the origin of the case, between $72M and $93M
The starting point is a reseller, CryptoBilis, an authorized Ledger distributor for Indonesia, Malaysia and the Philippines, which also sold Trezor, OneKey, Tangem and SafePal devices. From October 9, users began reporting emptied wallets on X and Reddit. On-chain analysts added up the losses, and the ranges vary widely depending on the source and the methodology used.
| Source | Loss estimate | Wallets drained | Chains covered |
|---|---|---|---|
| Bitquery | $93M+ | 311 | 5 |
| Lower range (early estimates) | ~$72M | — | — |
| Ledger (official) | “incident contained” to CryptoBilis | Not disclosed | Not disclosed |
A few days later, Ledger confirmed the exact nature of the attack: an unauthorized hardware implant. Not a software exploit, not a data breach, not a compromise of Ledger’s servers. A physical component added before the device reached the customer, changing the nature of the risk and the appropriate response.
Mark Karpelès (former CEO of Mt. Gox) documented the operating method after examining several suspect devices. A small circuit board hidden under the display — where the manufacturer would normally place protective foam — carries a microcontroller, an antenna, an LTE chip and an eSIM. The assembly observes what’s displayed on screen, notes the recovery phrase when entered by the user, and transmits it to the attacker over the cellular network. Once the seed is in hand, the attacker no longer needs the wallet: they reconstruct the account on any other device and drain the funds later. This explains the attack’s shape: discreet collection, followed by simultaneous drains.
The most worrying detail: the device arrives intact, under blister, and passes the Genuine Check. The security chip is genuine; the only reliable way to spot the extra component is to open the case.
Germany: two discoveries 48 hours apart
On October 11, a user under the handle @0xJohannes_ posted on X photos of an opened Ledger, bought a few weeks earlier at MediaMarkt. On the motherboard, cables and electronic components that have nothing to do with the original hardware. His message is sober: “This is a device purchased in store from an official reseller in Europe.”
Two points change the read of the event. First, the purchase took place in a physical store, from an official reseller, not on a marketplace or with an unknown merchant. Second, according to @0xJohannes_ and analyst @MagicalTux, this is an older variant of the implant, suggesting the tampering could have been active longer than initially thought. One detail caught observers’ attention: the antenna component bore markings evoking a Eurasian version, fueling the hypothesis that modified devices may be circulating beyond the regions initially hit.
On October 12, @0xJohannes_ returned to another MediaMarkt in Germany and bought a brand-new wallet directly off the shelf, filming. He opened the case. The device also contains an implant. The video is online. The buyer is calling for a recall, names distributor Aqipa, and says the second device has been sent to Ledger for analysis.
“This is a device purchased in store from an official reseller in Europe.”
@0xJohannes_, buyer, X post on October 11
Established vs not established: where things really stand
Ledger has confirmed the hardware implant. Ledger has confirmed its own systems and direct sales are not compromised. But on the European file, the company remains cautious: it continues to state that all confirmed implant cases linked to the October 9 incident concern devices sold via CryptoBilis. Despite the two German discoveries, Ledger has not formally extended its investigation perimeter to European channels.
Established: two tampered devices bought directly in-store at MediaMarkt in Germany, 48 hours apart. Established: at least one unauthorized hardware implant is the cause of the Asian drains. Established: the Genuine Check does not detect this modification. Established: no theft has been reported on the European devices.
Not established: that the two European devices stem from the same attack chain. Not established: that MediaMarkt is implicated in anything. It is an official reseller, but also an intermediary, with its own supply and logistics circuits. Not established: the real scale of the phenomenon in Europe.
Correction: no confirmed MediaMarkt shelf withdrawal
On one specific point, a rumor is circulating that needs to be corrected explicitly: contrary to what several discussions relay, no withdrawal of Ledger devices from MediaMarkt shelves has been formally announced by the retailer at this stage. Product pages for the Stax and Flex models remained accessible online after the alert. What exists are recall calls and community warnings, not a shelf withdrawal decision. The difference is not cosmetic: a withdrawal would have meant proven contamination at one link in the chain, which is not the case at this stage.
Why no software check can see a physical implant
The case goes beyond Ledger and deserves to be stated clearly. A hardware wallet is sold with a promise: your recovery phrase never leaves the device. That is the point of a hardware wallet versus software on an Internet-connected computer. A physical implant added before the sale turns this promise against its own verification mechanism. The chip is genuine, so the Genuine Check passes. The device is under blister, so the packaging is compliant. The visual is identical, so nothing alerts. The firmware says nothing, because the implant isn’t software: it observes a data bus and transmits.
In other words, software verification is structurally incapable of detecting a physical attack. This is not a flaw in Ledger’s control mechanism, it is a category limit: a software check cannot attest to the physical integrity of an object. If your recovery phrase has been read and transmitted, your wallet is no longer a safe: it has become a chain copied elsewhere, one you no longer control.
What to do if you bought a Ledger recently
- If you have not yet initialized your device: do not do it. That is when the implant can capture the recovery phrase. Enter nothing.
- If you have already set it up: migrate your assets to a new device bought directly from Ledger, with a new recovery phrase generated on that new machine. Move the funds, do not reuse the old seed.
- If you bought from a reseller: physically examine the inside of the device. That is the only reliable method. Ledger specifies that its Genuine Check cannot rule out all hardware modifications.
In all cases: Ledger will never call you, never write you in a private message, and never ask for your twenty-four words. The brand reminded this as the influx of victims creates ideal ground for recovery scams. Fake replacement devices sent to victims are the next predictable wave.
Conclusion: trust in the authorized channel degrades
If an implant can be introduced between the manufacturer and the point of sale, the “bought from an authorized reseller” guarantee loses its operational value. If a reseller can change ownership in a few weeks without the former owners having further system access — as documented with CryptoBilis, whose full stake was sold on August 3 to a person from Heilongjiang — trust in the authorized channel degrades mechanically.
Ledger faces a dilemma: officially extending its response to units distributed in Europe would require notifying customers who have suffered no loss but cannot know whether they are affected. Silence limits panic but potentially leaves devices in circulation that the company has not yet examined. In the meantime, the precautionary rule is simple, and it is the one every security practitioner has repeated for a week: for a hardware wallet, the main risk is not in the software but in the chain of custody. Buy directly from the manufacturer.
Sources
- The Defiant — coverage of the Ledger incident and the second German device
- Bitquery — loss estimate of $93M across 311 wallets and 5 blockchains
- @0xJohannes_ on X — videos and photos of both German devices
- @MagicalTux on X — technical analysis of the implant variant
- Ledger — official communications and reminder of anti-scam rules
This article is published for informational and educational purposes only. It does not constitute investment advice. Do your own research (DYOR) before any decision.
