Europe's Ledger implant case rests on a single MediaMarkt unit with no stolen funds
User @0xJohannes_ says the Ledger he bought at MediaMarkt holds extra internal wiring, a European report after a $93.4 million drain in Asia. Ledger says all confirmed cases came through CryptoBilis, so a compromised European retail channel is unproven.
The Investor · Invest desk
What happened
- Ledger opened an investigation around October 9-10 into drained wallets among customers of CryptoBilis, an authorized reseller in Indonesia, Malaysia and the Philippines.
- Ledger confirmed an unauthorized implant in at least one affected user's device and told the reseller to halt sales and shipments.
- The alleged implants are small circuit boards hidden where screen padding normally sits, with an antenna, LTE parts, an eSIM and a microcontroller wired to the internal data lines.
- Johannes said he bought the wallet about two weeks earlier and that it looks like an earlier implant version, one that does not hide behind the screen.
- Combined accounts now cite suspected cases linked to Asia, South America and Europe.
Why it matters
- What it limits constraint The tampered units passed Ledger's software security checks, and the wiring is hard to see without opening the case, so a reseller-bought device cannot be cleared from the screen alone.
- Who has to decide decision Owners of reseller-bought units have to choose between opening the casing and moving funds to a fresh seed on a verified device. A direct purchase protects only future buying.
- Who's exposed exposure MediaMarkt is a German chain with stores in at least six other countries, so if the claim holds, the exposed buyers sit well beyond CryptoBilis's three Asian markets.
- What doesn't add up contradiction The two outlets credit the 'Eurasian version' antenna label to different people, @MagicalTux and Mark Karpeles, so the one hint of region-specific builds has no agreed observer.
Next story · Invest · yesterday
Bitquery counts $102 million drained from 324 Ledger-linked wallets across six chainsConfirmed6 publishers
Independent estimates of the Southeast Asian losses run from roughly $72 million to more than $93 million across hundreds of wallets on Bitcoin, Ethereum and Tron [16]. The spread is $21.4 million, about 23% of the $93.4 million figure [20]. At that figure, which some analyses spread over more than 300 addresses [16], the average address lost no more than about $311,000 (or rather, the average address in that count) [19]. The European unit adds nothing to the total, because no funds were reported stolen from it [10].
Its owner offered two explanations for the quiet. Johannes said, "Either the device didn't work, or they were waiting for a more widespread usage of the compromised devices" [1]. Crowdfund Insider adds a third reading: limited reports do not show a manufacturer-level breach, and isolated tampering can occur without one [24].
Ledger's own position is narrower. The company has said its own systems and devices sold directly appear unaffected [5], and it told users that events like this strengthen its resolution, naming "reviewing authorized reseller controls" first among its steps [14]. Ledger Support had not addressed the MediaMarkt reports at the time of writing, bitcoin.com said [9].
We think the buy-direct advice circulating in these discussions is sound [12], and that the MediaMarkt report is one owner's account of one unit [21]. The strongest case against that caution is Johannes's own: a unit that works but has not yet fired looks the same as a dead one. Neither explanation can be tested from outside the device, so the missing theft is weak evidence in either direction. A second tampered unit from a MediaMarkt shelf would show us wrong.
What to watch
- Ledger's reply on the MediaMarkt claim, and whether its review of authorized reseller controls reaches retailers beyond CryptoBilis.
- An examination of the MediaMarkt unit by someone other than its owner, with the antenna label read and attributed consistently.
- Any drained wallet traced to a unit bought in Europe, which would move the loss record outside Southeast Asia.
Information, not investment advice. This story is general information about companies and markets, drawn from cited reporting. It is not a recommendation to buy, sell or hold any security; check the cited sources before acting.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap+40
- Incentives
- Not scored
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Johannes said, "Either the device didn't work, or they were waiting for a more widespread usage of the compromised devices."
- [2]
Ledger launched an investigation around October 9-10, 2026, into drained wallets among customers who purchased through CryptoBilis, an authorized reseller operating in Indonesia, Malaysia and the Philippines.
- [3]
Ledger confirmed that at least one affected user's device contained an unauthorized hardware implant, and instructed the reseller to halt sales and shipments.
- [4]
In its most recent update, Ledger clarified that all confirmed cases affected by this exploit were limited to devices sold through CryptoBilis.
- [5]
Ledger has stated that its own systems and devices sold directly by the company appear unaffected.
- [6]
The alleged implants are described as small circuit boards concealed in the space normally occupied by screen padding, reportedly including an antenna, cellular or LTE components, an eSIM, and a microcontroller wired to monitor the device's internal data lines.
- [7]
All tampered devices passed Ledger software security checks.
- [8]
The hidden modifications can be difficult to detect without opening the casing.
- [9]
At the time of writing, Ledger Support had not addressed the reports concerning alleged tampered devices from European resellers.
- [10]
In the European case, no funds were reported stolen from the MediaMarkt-purchased unit.
- [11]
Community suggestions include physically inspecting the interior of reseller-bought units rather than relying solely on software authenticity checks, and moving assets to a freshly generated seed on a verified device if risk is suspected.
- [12]
The consistent recommendation circulating in these discussions is that buyers should obtain devices directly from the manufacturer rather than through intermediaries.
- [13]
MediaMarkt is a German chain of stores with a presence in several European countries, including Italy, Spain, Turkey, Poland, Austria and the Netherlands, among others.
- [14]
Ledger concluded: "We are continuously improving that work now and events like this strengthen our resolution: reviewing authorized reseller controls, advancing hardware protections, and cooperating with authorities."
- [15]
MediaMarkt operates in at least six countries beyond Germany named by the source.
- [16]
Independent estimates of losses tied to the Southeast Asian cases range from roughly $72 million to more than $93 million across hundreds of wallets on Bitcoin, Ethereum and Tron; some analyses put the figure near $93.4 million involving more than 300 addresses.
- [17]
Former Mt. Gox CEO Mark Karpeles added that the antenna in the MediaMarkt wallet read "Eurasian version", hinting at different versions depending on the mobile frequencies used in each region.
- [18]
Commentary from @MagicalTux noted that an antenna component carried labeling indicating a Eurasian version.
- [19]
The average loss per address is at most about $311,000 if $93.4 million is spread over 300 addresses; the true average is lower because the count is 'more than 300'.
- [20]
The gap between the low and high loss estimates is $21.4 million, about 23% of the $93.4 million figure.
- [21]
According to user @0xJohannes_, a Ledger unit bought in-store from an official European reseller, identified in related coverage as MediaMarkt, showed additional cables that do not appear in genuine units.
- [22]
Johannes, who allegedly acquired the wallet two weeks ago, said the implant seemed to be an earlier version that does not hide behind the device screen.
- [23]
Combined accounts now cite suspected cases linked to Asia, South America and Europe.
- [24]
Skeptics have cautioned against assuming widespread contamination from limited reports, noting that isolated tampering incidents can occur without indicating a systemic manufacturer-level breach.
Sources
2 independent publishers whose own reporting we read for this story.
- crowdfundinsider.comTampered Ledger Hardware Wallets with Hidden Spy Implants Reportedly Expand Beyond Asia to Europe
1 article · October 12, 2026
- news.bitcoin.comUser Exposes Hidden Hardware Implant in European Ledger Wallet
1 article · October 11, 2026
Topics and entities
Topics
- Crypto theft and exploits
- Hardware wallet supply-chain security