The cold is getting warmer. Didn’t the affair of the rigged Ledgers therefore remain confined to South-East Asia? Obviously not. A European user claims to have found the same hardware implant in two devices purchased in store from MediaMarkt, and is calling for an immediate product recall. Enough to give a cold sweat to all those who bought their wallet outside the official store, while the Asian loot exceeds 100 million dollars.
The key points of this article:
A user known as Johannes claims to have found a spy implant in two Ledgers. Both devices came from two different MediaMarkt stores, the second purchased this very Monday.
The modifications noted are identical to those of Asian devices, additional cables and LTE module included. A widespread supply problem is emerging, rather than an isolated incident.
Store records point to Aqipa GmbH as distributor, a company that supplies all of Europe. An employee also assures that the device was not a customer return.
Johannes calls for an immediate product recall. Both devices are being analyzed, one by Mark Karpelès, the other by Ledger.
Two stores, two devices, the same spy
It is through an update published this Monday on X that Johannes confirms the suspicions that he himself had raised last week, with a first device purchased in another MediaMarkt store. In fact, he has just purchased a second device in another MediaMarkt store, with filmed unboxing to support it. Bottom line: spyware, once again. However, the diagram is identical to that of the fake Ledgers discovered in Asia, with the same internal modifications, additional cables and LTE module included. As a result, the problem would potentially affect the stocks of MediaMarkt and Saturn, more than 1,000 stores in 11 countries.
“The Ledger supply chain is compromised in Europe as well. Ledger should issue an immediate product recall to protect users. »
The hypothesis of customer returns re-served as new first crossed his mind. However, a MediaMarkt employee denied this lead. The purchased device was not a return, and returned Ledgers go directly to the manufacturer. So there remains the logistics track. Store records show that the stock comes from Aqipa GmbH, a distributor that Ledger's CTO did not immediately confirm as a direct intermediary between the manufacturer and MediaMarkt, but which appears to play this role. However, Aqipa distributes throughout Europe. In other words, any physical store supplied by this channel could be affected.
As a reminder, the affair began in Southeast Asia, where wallets sold by the official reseller CryptoBilis were emptied of their funds. The dealer had even changed ownership before the thefts. In practice, the implants hidden in the space normally occupied by the screen padding embed a microcontroller, an LTE cellular module, an antenna and an eSIM. Enough to read the seed phrase displayed at initialization, then send it via mobile network. Enough to empty wallets without any user signing anything.
A product recall requested, Ledger remains cautious
Johannes does not just warn, he also acts. On the one hand, the first device went for analysis to Mark Karpelès, the former boss of Mt. Gox who helped document the Asian implants. On the other hand, the second joins the Ledger teams. His message ends with a simple piece of advice: if you bought your Ledger somewhere other than the official store, check your device. That said, no theft of funds has yet been reported on the European system. The implant was perhaps inoperative, or awaiting activation on a larger scale.
