The scariest supply-chain attack of 2026 just crossed a border it wasn’t supposed to cross.
On October 9, wallets drained through devices sold by CryptoBilis, an authorized Ledger reseller in Southeast Asia — a case we traced in depth after Malaysian corporate records showed the reseller had been quietly acquired in March. That story had a shape: buy a trusted distributor, implant its stock, harvest seeds for months, sweep in one night. Ugly, but containable. One reseller, one region, one playbook.
Then Europe answered.
Two stores, two implants
On October 11, an X user posting as Johannes reported that a Ledger Nano X bought weeks earlier at a MediaMarkt — the German electronics chain, an authorized Ledger reseller per the company’s own directory — contained additional wiring that a genuine device should not have. Mark Karpelès reviewed the teardown photos and identified the modification as another spy implant, notably an earlier generation than the designs he had examined from Malaysia: less concealed, with the giveaway antenna not yet hidden away.
He also spotted a detail that reframes the whole operation. The antenna, he said, carried a printed marking: “Eurasian version.” His read: the implant operation built variants tuned to the mobile frequencies of each target region. A device that exfiltrates seed phrases over LTE needs its radio to work where it ships — and labeling the build suggests inventory management, not one-off tinkering.
The next day, October 12, it got worse. Johannes bought a second Nano X at a different MediaMarkt store, recorded the unboxing, and found the same modifications — extra cables and an LTE module. Two stores, two devices, matching hardware. Neither of his wallets had been drained — “either the device didn’t work, or they were waiting for more widespread usage,” he speculated, echoing what investigators keep saying about this attack class: a holder of harvested seeds can simply wait.
A MediaMarkt employee, per Johannes’s account, said the unit was not a customer return (returned Ledgers go back to the manufacturer), and store records identified the stock source as Aqipa GmbH — a Europe-wide electronics distributor. The first device has been mailed to Karpelès and the second to Ledger for forensic examination. None of this is yet independently verified: it is one buyer’s account, a researcher’s assessment of photographs, and a paper trail that raises questions faster than anyone can answer them.
The version archaeology
The “Eurasian version” label lands on top of what researchers already knew: this implant has generations.
The technical deep-dive comes from Tibane Labs, which obtained two implanted Nano X units through Japanese marketplaces and documented the lineage:
| Generation | Where found | What changed |
|---|---|---|
| Prototype (2025) | Surfaced via a Reddit warning; torn down by Joe Grand | Hand-soldered enamel wires from the OLED’s SPI lines to an add-on board — a one-off |
| Gen 2 | Yahoo! Auctions Japan | Custom Kapton flex circuit with proper silkscreen; factory-test-pad landing; implant replaces part of the battery |
| Gen 3 | Amazon Japan, China-based seller, shipped from Malaysia | Color-matched black coating; Nordic nRF9151 LTE module; eSIM; custom antenna at its second revision (AC-A2016-NANO-V1.1); footprint cut to key into the Ledger’s own parts — drop-in installation, optimized for a production line |
| ”Earlier version” | MediaMarkt, Europe | Per Karpelès’s photo assessment: visible antenna, implant not hidden under the screen — the design predates the Malaysia specimens |
The BleepingComputer writeup adds the market signal: researchers had been showing Ledger X implants since September 16, with tampered devices circulating at nearly half the official price — the classic discount of gray-market tampered stock. And Karpelès notes the newer builds show signs of being manufactured to order rather than hand-modified. Panelized flex PCBs from a board house, a custom antenna already at revision two, keying that lets an unskilled worker drop the implant into place: this is what an assembly line looks like before you call it one.
Which makes the European find genuinely strange. The devices on German shelves are the older, less concealed design. The plausible readings: early-production implanted units have been sitting in European distribution for a long time; or different batches seeded different regions at different times. Either way, “Eurasian version” now reads less like a curiosity and more like a product SKU.
Why the CryptoBilis playbook doesn’t explain this
Here is the part investigators cannot yet close. The Malaysia case had a mechanism: the reseller changed owners in secret, and the tampering maps onto the new regime. Europe has no such story. Aqipa GmbH is a long-standing pan-European distributor; MediaMarkt and Saturn (its sister chain, ~1,070 stores across 11 countries in the group) are authorized retail, not a shell anyone bought last spring. Nobody has alleged the distributor or the retailers did anything wrong — and nothing in the public record suggests they did.
That leaves open the uncomfortable possibilities: tampering further upstream in logistics, in transit, in warehousing — at some point where sealed boxes passed through hands nobody was watching. A tamper operation that can reach a mainstream European retail chain’s shrink-wrapped stock is a different class of problem than one that bought a reseller in Kuala Lumpur. It is also, so far, exactly two devices. The honest position is: two confirmed-by-photographs European reports, zero confirmed-by-Ledger European cases, and a supply chain nobody has yet mapped.
Ledger’s October 11 statement held the earlier line: all confirmed cases tied to the October 9 drains involve CryptoBilis devices, direct sales are unaffected, and the company is working with authorities and the SEAL 911 response group. The European units were still in the mail to their examiners at that point. Loss estimates in the underlying case, meanwhile, have crept past $93 million.
What actually protects you
The defenses are the ones we laid out when this story broke in Southeast Asia, now with wider blast radius — see our CryptoBilis case study for the acquisition trail and the address-level tracing piece for where the money went:
- Buy from the manufacturer directly. Every confirmed compromised device so far moved through a reseller channel. “Authorized” now means “authorized as of the last ownership change you didn’t hear about” — and possibly less than that, if the European trail holds.
- Software checks cannot clear hardware. Ledger’s genuine check verifies the seed phrase-guarding secure element; an implant that taps the display sits outside its view. A passing check means the chip is genuine, not that the device is clean.
- Sealed packaging proves nothing. At least one examined implant device arrived in factory-intact shrink wrap.
- A device that has been set up through an untrusted channel should be treated as burned. The fix is a new seed on trusted hardware, then transfer — not inspection, not reassurance, not waiting. Johannes’s devices hadn’t drained yet; “yet” is the operative word in this attack class.
- The old pre-filled-seed scams were the warm-up. Our hardware wallet scam taxonomy covers the classic version of this attack; the implant era is its industrial upgrade.
What to watch
Three checkpoints will decide whether Europe is a footnote or a second front: (1) Ledger’s forensic read on the second MediaMarkt device — same implant family or not; (2) Aqipa’s stock records, if published or subpoenaed, showing whether the two units share a batch; (3) whether other European buyers open their devices and what they find. Johannes has called for a recall. If you hold a reseller-bought Ledger in Europe, the calculus is simple: the cost of re-seeding on a factory-direct device is an hour; the cost of being wrong about a “Eurasian version” antenna is everything on the keys.
We will update this page as forensic results land.
Frequently Asked Questions
Has Ledger confirmed the MediaMarkt devices were tampered?
No. Ledger's October 11 statement said all confirmed cases tied to the October 9 draining incident involved devices sold through CryptoBilis, and the company had no indication its own infrastructure or direct sales were compromised. The MediaMarkt reports come from one buyer's teardown photos and video, with Mark Karpelès assessing the published images. Both devices have been mailed out for examination — the first to Karpelès, the second to Ledger — so independent forensic verification is pending.
What does the 'Eurasian version' marking actually mean?
Per Mark Karpelès, the antenna inside the European device carried a printed label reading 'Eurasian version.' He interpreted it as a hint that the operation produced implant variants tuned to the mobile frequencies used in each region — a European LTE band differs from Asian ones, so an implant that phones home over cellular needs regional tuning. A version label implies inventory management: someone is tracking which build ships where.
Does this mean all MediaMarkt or Saturn stock is compromised?
No. Two devices from two stores are the entire reported sample. The roughly 1,070-store, 11-country network describes the retail group's total footprint, not affected locations. No evidence suggests store staff or the distributor Aqipa participated in any tampering; where in the chain the devices were modified remains unknown.
Can Ledger's genuine-device check catch these implants?
No. The genuine check verifies the secure element — the chip that holds the keys — and the implants leave it untouched. They tap the display lines, capture the recovery phrase during setup, and transmit it over an embedded LTE module with an eSIM. Software verification cannot see added hardware, and at least one previously examined tampered device arrived in intact shrink wrap.
I bought a Ledger from a European retail store. What should I do?
If it is still uninitialized, do not initialize it — an implant can only capture the recovery phrase while it is displayed during setup. If it is already set up, generate a new seed on a device you have reason to trust (ideally bought directly from Ledger) and move your funds. Keep the receipt and packaging; investigators need the purchase trail.