European Reseller MediaMarkt Linked to Implanted Ledger Wallet, Raising New Questions
Wallet from a European chain store turns out to be rigged
A user going by Johannes posted on October 11 that a Ledger Nano X wallet bought in-store from an official reseller in Europe contained a hidden hardware implant. The device was purchased at MediaMarkt, a well-known electronics retailer, roughly two weeks before the report. Johannes shared teardown photographs showing extra internal wiring that he described as impossible in a legitimate device. The finding is significant because every confirmed case Ledger had previously tied to its fund-draining investigation involved devices sold through a Southeast Asian reseller called CryptoBilis, not through mainstream European retail.
Mark Karpelès, who has been independently examining implanted Ledger devices, endorsed Johannes's identification. In a public post he called it a confirmed spy implant that appears to match the first-generation version he has been analyzing. His assessment covers the photographed hardware, not an independent verification of where the device was purchased.
What was found
- Johannes posted teardown photos of the Nano X showing internal cables absent from a genuine device.
- The retailer was identified as MediaMarkt, an official Ledger reseller in Europe.
- Karpelès confirmed the implant matches a version he has examined, calling it a v1.0 variant.
- No cryptocurrency had been transferred to any attacker from this particular device.
- Ledger contacted Johannes and asked him to ship the device to the company; he said he was considering sending it to independent security researchers instead.
Ledger's own statement leaves this case unaddressed
In an update posted October 11, Ledger said every confirmed case connected to the fund-draining incident it disclosed on October 9 involved devices sold through CryptoBilis, a Southeast Asian reseller that had halted hardware-wallet sales while the investigation continued. The company said its own systems and direct sales channels remained unaffected. Ledger's statement did not mention Johannes's device or the MediaMarkt purchase channel.
On October 10, Ledger's support account had confirmed that one affected user's device contained an unauthorized hardware implant. It also announced that CryptoBilis had stopped selling all hardware-wallet inventory during the investigation.
How the implants work and why packaging does not protect against them
Karpelès explained that the added hardware monitors data sent to the wallet's display, aiming to capture and transmit the seed phrase. The seed phrase is a list of words that serves as the master key to cryptocurrency stored on a hardware wallet. Hardware wallets are physical devices that keep private keys offline, separate from a computer or phone, to reduce the risk of remote theft.
Karpelès also noted that the added implant cannot be detected through software. Ledger's built-in verification system checks specific device components, but the implant adds new hardware rather than altering existing parts, making it invisible to that software check.
He also reported that an implanted device he received from Malaysia had intact, professional-looking shrink wrap. The extra hardware was hidden where the screen's padding normally sits. This shows that an unopened package does not guarantee a device is genuine.
What is confirmed and what remains open
Confirmed: Ledger's October 11 update links all known fund-draining cases to CryptoBilis. It confirmed on October 10 that at least one user's device contained an unauthorized implant. CryptoBilis has stopped selling hardware wallets.
Reported but not yet officially confirmed by Ledger: The MediaMarkt-purchased Nano X contains a hardware implant. Karpelès supports the identification based on photographs, but Ledger has not commented on this specific device or on European reseller channels. No funds were drained from this device, so it is not currently linked to the known theft incident.
What is unclear: Whether the same group behind the CryptoBilis operation also compromised European retail channels. Whether other devices sold through mainstream European resellers contain implants. Ledger's investigation and response so far have focused on CryptoBilis, not on European reseller channels.
What Ledger recommends
Ledger's instructions for CryptoBilis buyers are to leave any unused devices uninitialized and not connect them. Buyers who already set up a device through CryptoBilis should generate a new seed phrase on a device purchased directly from Ledger and move their assets there.
Karpelès separately advised anyone who discovers an implant to create a new seed on a trusted device and transfer their assets, rather than continuing to use the old seed even if no theft has yet occurred.
Ledger urged affected users to contact support through its official website and warned it will never call, send a direct message, or ask for a 24-word recovery phrase. The company said it is reviewing controls for authorized resellers and reminded them never to restock returned products.
Source
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.