The hardware-wallet implant scandal that surfaced in Asia earlier this month has reached Europe. On October 11, 2026, a user posting as @0xJohannes_ said they discovered a hidden spy component inside a Ledger device purchased weeks earlier at a physical Mediamarkt store, which is listed as an official Ledger reseller.
According to @0xJohannes_, the implant found in the device appeared to be an older version of the component, fitted with extra visible wires, in contrast to newer variants reported to be hidden closer to the device's screen. The user said the device had not transferred any funds to an exploiter-controlled account, and noted that the packaging of the unit looked intact at the time of purchase.
Former Mt. Gox CEO Mark Karpelès reviewed photographs of the implant found in Europe. He identified an inscription on the module's antenna reading, in his account, "Eurasian version." Karpelès said he believed attackers had produced different variants of the component tuned to regional LTE frequencies, suggesting the hardware was built with multiple markets in mind rather than a single region.
A threat first flagged in Asia
Ledger confirmed on October 10, 2026, the existence of hidden microcontrollers capable of intercepting recovery phrases and transmitting them over a cellular network, without breaking the device's security chip. Until the Mediamarkt report, the threat had been understood to be confined to customers of CryptoBilis, a reseller operating in Malaysia, Indonesia and the Philippines. Assets affected in that earlier incident reportedly included bitcoin, ether and tron.
Compounding the risk, Ledger Live, the company's companion application, recognizes compromised devices as genuine because its checks are limited to software and do not detect an added physical circuit inside the hardware itself.
Calls for retail vigilance
@0xJohannes_ suggested that staff at retail stores selling hardware wallets be alerted to watch for irregularities in packaging or in returned units, as a practical line of defence against tampered devices re-entering the supply chain. The European case indicates that reliance on sealed packaging alone may not be sufficient to rule out tampering, since the user described the box as appearing to be in good condition.
For European buyers, the episode raises the question of how far the compromise extends beyond the Asian distributor originally implicated, and whether devices sold through mainstream retailers such as Mediamarkt could carry the same risk. No further details on the scale of the European exposure have been established beyond the single reported case.
