Manipulated Ledger Wallet Allegedly Bought at MediaMarkt Raises Questions Beyond Asia

A user identified on X as Johannes (@0xJohannes_) has published images of an opened Ledger hardware wallet that he says he purchased weeks earlier at a MediaMarkt store in Europe. The photos reportedly show extra cables and electronic components that are not part of the device's original hardware, raising questions about whether a security incident previously reported in connection with Asian resellers has a European dimension as well.

Johannes described the device as containing what appears to be an older version of what he called a "spy implant." He wrote on X: "PSA the ledger incident isn't limited to Asia. This is a device purchased in store from an official reseller in Europe (a legitimate device doesn't have any of these cables as can be seen in picture 2). This even seems to be an old version of the 'spy implant' even though the..."

No cryptocurrencies have so far been stolen from this particular device, according to the available information. It has not been confirmed whether this case is connected to previously reported attacks involving manipulated Ledger hardware.

Reports surfaced on Friday

Reports describing manipulated devices and alleged crypto thefts worth millions first became known on Friday. Ledger confirmed an incident in which it found an unauthorized hardware component in at least one affected device. The company stated that the incident is limited to devices originating from CryptoBilis, an authorized Ledger reseller operating in Asia.

A reseller that changed hands

CryptoBilis changed ownership a few months before the attacks became known. On August 3, the previous owner transferred all company shares to a person from Heilongjiang province in China. The original founders of CryptoBilis had already left the company in March and have had no access to its systems since their departure.

The sequence of events, a change of control followed months later by reports of tampered hardware, has drawn scrutiny to the reseller's supply chain. For now, Ledger's confirmed findings are tied specifically to CryptoBilis-sourced devices, while the case described by Johannes involves a separate retail channel in Europe.

European consumers who have purchased Ledger devices through retail chains such as MediaMarkt now have an additional reason to inspect their hardware closely before use, given that the images shared online point to physical alterations inside at least one unit sold through an official outlet.