User Johannes of X stated on October 12 that he purchased a tampered Ledger Nano X at a MediaMarkt store, another major European electronics retailer, and is calling on Ledger to recall the product. Ledger has so far only confirmed that devices sold by its Southeast Asian distributor, CryptoBilis, were compromised.
(Prior context: Ledger Supply Chain Tampering Case: 72-Hour Update — All Stolen Coins Originated from Southeast Asian Distributors)
(Context supplement: SlowMist speculates: How Ledger was compromised with a spy module to steal seed phrases)
The tampering scandal involving Ledger, a leading cold wallet manufacturer, appears to have expanded from Southeast Asia to Europe. Yesterday evening, X user Johannes posted that he had purchased a second Ledger Nano X at a major European electronics retailer, MediaMarkt, and upon unboxing, discovered the same modifications as his previous device. He has demanded that Ledger immediately recall the product.
Ledger, MediaMarkt, and the distributor Aqipa he named have not yet confirmed.
UPDATE: I can confirm that the Ledger supply chain is also compromised in Europe. @Ledger should initiate an immediate product recall to protect users.
I just bought a second device from a different Mediamarkt location today, recorded the unboxing process, and discovered… pic.twitter.com/TjVCx8Hk61
— Johannes (4, 4) (@0xJohannes_) October 12, 2026
Two devices, two stores: What Johannes said
Johannes noted in his post on October 11 that this incident is not limited to Asia: the device was purchased weeks ago at a retail store of an official distributor (Mediamarkt) in Europe, and upon opening it, several extra wires not found on genuine units were discovered on the motherboard. He believes this is an older version of the implant; newer versions are typically hidden near the screen and are much harder to detect. The device never transferred funds to the attacker, leading him to speculate that the module may not have been functioning properly, or that the attackers were waiting for more modified devices to enter the market.
Later that day, he posted a screenshot of a private message with Ledger’s CTO, Charles Guillemet: Johannes asked whether these wires were not authentic, and the response was, “No, they shouldn’t be here,” along with a link to Ledger’s official support page. This screenshot was posted solely by Johannes; Guillemet has not publicly confirmed it.
Dawg, I have the CTO of Ledger in my DMs, STFU pic.twitter.com/8nHJaNNk2B
— Johannes (4, 4) (@0xJohannes_) October 11, 2026
In his October 12 update post, Johannes wrote that he can confirm Ledger’s supply chain in Europe was also compromised: the modifications to the second device were identical to the first, including extra wires and an LTE module, with an antenna clearly marked in the accompanying image. His unboxing video, 2 minutes and 31 seconds long, shows the process of removing the shrink wrap, prying open the casing, and revealing the internal red wires; another photo shows a store shelf with packaging printed in German. He also called out: “Ledger should immediately initiate a product recall to protect users.”
Here is the video proof, brand new device, directly from the store—video quality is a bit poor, sorry. pic.twitter.com/TbW3cUp4pR
— Johannes (4, 4) (@0xJohannes_) October 12, 2026
The staff's statement and Aqipa: sourcing information relies on word of mouth
Johannes initially suspected these devices were returned items being resold as new, but a MediaMarkt employee told him these devices were not returns—returned Ledgers are sent directly back to the manufacturer. He noted that store records indicated the source was Aqipa GmbH (an Austrian consumer electronics distributor), and posted a distant photo of the store computer screen.
Johannes also wrote that Ledger’s CTO is unsure whether Aqipa is a direct distributor between Ledger and MediaMarkt, but he believes it appears to be.
Regarding the current destinations of the two devices, the first has been sent to Mark Karpelès, former CEO of Mt. Gox, and the second is en route to Ledger for analysis.
Look at the decomposition results first, then discuss recall.
The same buyer, two different stores, identical modifications—this pattern is not a random incident and warrants high caution. Next, there are three things to watch:
- Ledger and Karpelès' disassembly results for the two devices
- Have MediaMarkt or Aqipa issued statements regarding their sourcing and inventory?
- Has Ledger expanded its warning scope from CryptoBilis to European channels?
📍Related Articles📍
She bought a "scam cold wallet" on JD.com and lost 4.35 BTC that she stored in it.