Buyer finds Ledger spy implant in German MediaMarkt wallet

In short

• A user says he found a Ledger wallet with a spy implant bought at a German MediaMarkt store on 12 October 2026.
• Mark Karpelès confirmed one implant; Ledger has only confirmed cases tied to reseller CryptoBilis in Southeast Asia.
• Loss estimates range from more than $72m to more than $86m, with over $10m frozen, and none is confirmed by Ledger.
• No refund, replacement or recall programme has been announced for European buyers.

A tampered Ledger found in a German store

A Ledger hardware wallet bought from a European high-street retailer contained the same spy implant found in devices sold in Southeast Asia, according to a post by the crypto researcher Johannes (4, 4) (@0xJohannes_) on X on 12 October 2026. Johannes said he bought a second device at a different MediaMarkt location that day, filmed the unboxing and found the implant inside. Ledger, the French company that makes the wallets, has not confirmed any European case.

How the implant steals a seed phrase

A hardware wallet is a small device that keeps a user's crypto keys offline. During setup it shows a seed phrase, a list of words that can restore the wallet, and anyone who has that phrase can take the funds. The implant sits under the screen and copies the phrase as it appears, according to Mark Karpelès, chief executive of Karpelès Lab, who has been opening tampered Ledger devices.

Karpelès confirmed the European find. "Another spy implant confirmed," he said on X, adding that it looked like an earlier version of the implant he is studying, "meaning there were more iterations." He wrote on Saturday that the implants watch the screen to "take note and transmit the seed phrase you'll be setting up on your ledger," and that they have "evolved a lot in recent months," becoming harder to spot and easier to install. "The attacker may decide to steal your assets today, or in a year," Karpelès said.

Ledger confirms one implant, in Asia

Ledger has confirmed the problem in at least one case. "Ledger can confirm that one of the impacted users' devices contained an unauthorised hardware implant," the company's support account wrote. Ledger traced the affected devices to CryptoBilis, a Southeast Asian reseller, and said CryptoBilis has stopped selling all hardware wallet inventory until the investigation ends. Ledger said it has "no indication" that its own systems or services were compromised, and it has not said whether it is aware of any cases in Europe.

Losses estimated at $72m to $86m

The scare surfaced on Friday 9 October, when Ledger said it was looking into reports of lost funds from Southeast Asian users who bought from CryptoBilis, and asked the reseller to pause all sales and shipments. On-chain trackers began counting losses. Security researcher tanuki42 put the total at more than $72 million, while analyst Specter traced more than $86 million from hundreds of victim wallets. Blockchain analytics firm Arkham said over $80 million had reportedly been taken across Bitcoin, Ethereum and Tron, adding that the cause was unconfirmed.

Some of that money has been stopped. tanuki42 said work with Tether and law enforcement had frozen more than $10 million. The estimates still vary widely and none of them has been confirmed by Ledger.

What holders should do now

For ordinary holders, the practical advice is blunt. Ledger told users who bought from CryptoBilis not to set up their devices, and said those who already have should move their assets to a new Ledger with a new seed phrase. Karpelès gave the same instruction to anyone whose seed phrase was created on an implanted device. Johannes urged anyone who did not buy directly from Ledger's online store to open the device and check it themselves. He said the European device never sent funds to an attacker, and that it is unclear whether the implant failed or the attackers were waiting.

Traders and security researchers are now asking how far the tampering reaches. AMBCrypto reported that CryptoQuant analyst Darkfost sees more than seven resellers and e-commerce platforms at high risk, citing regional proximity, and that other reseller names such as Lazada merchants have come up in discussions. Zach Herbert, chief executive of wallet provider Foundation, warned that most hardware wallets made in China or the wider Asian region could be targeted, including Ledger. Ledger has pledged better security, saying it is "continuously adding security mitigations and is working on further, enhanced anti-tampering solutions."

No refund, replacement or recall programme for European buyers has been announced. Johannes called on Ledger to "initiate an immediate product recall to protect users." Ledger has not said whether it will extend its investigation beyond CryptoBilis, and it has not confirmed the European claim.

Questions readers ask

Has Ledger confirmed a spy implant in European devices?

No. Ledger has confirmed that one impacted user's device contained an unauthorized hardware implant, and it traced the affected devices to Southeast Asian reseller CryptoBilis. The European claim rests on posts by Johannes (4, 4) (@0xJohannes_) on X on 12 October 2026 and a confirmation from Karpelès Lab chief executive Mark Karpelès. Ledger has not said whether it is aware of any European cases.

How much crypto has been lost in the Ledger implant case?

Estimates vary and none has been confirmed by Ledger. Security researcher tanuki42 put losses at more than $72 million, analyst Specter traced more than $86 million from hundreds of victim wallets, and Arkham said over $80 million had reportedly been taken across Bitcoin, Ethereum and Tron. tanuki42 said more than $10 million has been frozen with Tether and law enforcement.

What should I do if I bought a Ledger from a reseller?

Ledger told users who bought from CryptoBilis not to set up their devices, and said those who already have should move their assets to a new Ledger with a new seed phrase. Mark Karpelès gave the same advice to anyone whose seed phrase was created on an implanted device. Johannes urged buyers who did not purchase directly from Ledger's online store to open the device and check it.

Our view

Ledger's problem is no longer a supply-chain incident in one corner of Asia; it is a question of whether the company can still be trusted as the default answer to self-custody. A single user's photographs from a German MediaMarkt do not prove a European outbreak, and Ledger has confirmed only the CryptoBilis cases. But the company's silence on Europe is costly. When a device that exists to protect a seed phrase can be opened, rewired and resold without the maker noticing, the brand's core promise is what fails, not just one batch of inventory. Ledger should confirm or deny the European findings quickly, publish the serial numbers and reseller routes it has checked, and offer European buyers a clear replacement path. Until it does, the reasonable position for holders is the cautious one: verify the device, or move the assets.

Follow the latest updates as they happen on NewsFeeds.

— Keshav Aggarwal

What to watch: Ledger has not said whether it will investigate beyond CryptoBilis or confirm the European case, and no recall or refund for European buyers has been announced.