When 0xJohannes_ opened a Ledger wallet bought from a MediaMarkt store on Oct. 11, he posted what he described as an unboxing video of a fresh device taken directly from the shop. He said it contained unauthorised hardware and called for an immediate product recall.
He said no funds had been transferred from the first wallet to an exploiter.
The following day, Oct. 12, the buyer bought another Ledger wallet at a different MediaMarkt store. He reported finding the same unauthorised cables and cellular modules inside.
A MediaMarkt employee told him the second device was not a return. The employee said returned Ledgers are sent back to the manufacturer.
Store records identified Aqipa GmbH as the source of the inventory. Aqipa announced a Ledger distribution partnership in 2023 that initially covered Germany and Austria.
The reports followed Ledger’s disclosure on Oct. 9 of a fund-draining incident involving devices sold through the Southeast Asian reseller CryptoBilis.
By Oct. 13, MediaMarktSaturn had removed all Ledger products from its stores and online platforms across all countries.
A MediaMarktSaturn spokesman said on Tuesday: 'The MediaMarktSaturn Retail Group has removed all products of the manufacturer from its stores and online platforms and is in contact with the manufacturer. We take this incident very seriously.'
Ledger Support has maintained that every confirmed case involves devices sold through CryptoBilis. It said Ledger’s systems and direct sales channels remained unaffected.
The company said it had found no user fund losses resulting from the incident so far. It also said there was no evidence that its infrastructure, systems or services had been compromised.
Ledger is investigating reports beyond CryptoBilis, while it has not confirmed whether tampered devices exist in Europe.
It has said that implants could exfiltrate a user’s recovery phrase over a cellular network. The buyer sent the second device to Ledger for analysis.
Mark Karpelès, the former Mt. Gox CEO, also reported on Tuesday that a Ledger Flex he bought at Singapore Airport contained a spy implant.
Ledger referred to its CryptoBilis investigation update and did not directly respond to the Singapore case.
Ledger has told customers with doubts about a purchased device to verify it through its official customer service channels.
Comments (0)