Reports of modified devices in Germany widen concerns after the Southeast Asian wallet-draining incident initially linked to roughly $93 million in losses.
Europe has entered the Ledger hardware-wallet security investigation after a customer reported finding an unauthorized implant in a device purchased in Germany.
In an October 13 statement, Ledger confirmed that MediaMarktSaturn had stopped selling Ledger devices in stores and online, with Ledger’s agreement, while the investigation continues. The company said the action followed a German customer’s implant report and that no loss of funds had been reported in that case. Ledger’s European update.
The development raises serious questions about the security of hardware-wallet distribution beyond Southeast Asia. However, reports of European tampering should not yet be described as a confirmed continent-wide theft operation.
A customer posting as Johannes said he purchased two Ledger devices from different MediaMarkt locations and found similar modifications in both, including additional cables and an LTE module. He also said store records identified Aqipa GmbH as the inventory supplier. Those details remain his account, pending the manufacturers’ investigation. Johannes’s report.
Pete Rizzo amplified the findings, warning that a retail network spanning more than 1,000 stores across 11 countries could potentially be affected. That figure describes the claimed potential reach of the distribution network; it does not establish that every store or country received compromised wallets. Rizzo’s post.
How the confirmed implant steals a recovery phrase
Ledger’s cybersecurity team, Donjon, has provided a technical explanation of the implant found in the CryptoBilis investigation.
According to Ledger, the added component reads information shown on the wallet’s screen. During setup, it captures the displayed 24-word recovery phrase, decodes it and transmits it over LTE using an embedded eSIM. Ledger says the implant operates separately from the Secure Element and does not modify the Ledger operating system or transaction signatures. Ledger’s technical statement.
That is a critical distinction. Criminals can attack the physical device around its security chip, capturing the recovery phrase without needing to defeat the chip itself. Once that phrase is exposed, an attacker can recreate the wallet and access its assets.
The loss estimate has moved beyond $93 million
The Southeast Asian incident became widely associated with approximately $93 million in suspected losses. Bitquery’s updated investigation now estimates $102 million taken from 324 wallets across six blockchains, following the identification of additional drains.
This remains Bitquery’s estimate. Ledger says it has not confirmed the total number of affected users or the value lost, and that all verified losses linked to the October 9 incident involve devices sold through CryptoBilis. It has not verified a drain involving a device purchased elsewhere. Bitquery’s investigation, Ledger’s statement.
A warning against keeping everything behind one recovery phrase
The incident highlights why buying a hardware wallet cannot be the final step in a security plan.
Ledger tells CryptoBilis customers not to initialize unused devices. Customers who have already set them up should transfer assets promptly to a new signer with a newly generated recovery phrase. Restoring an exposed phrase onto a replacement device does not remove the exposure. Ledger’s customer guidance.
For crypto holders more broadly, the lesson is to limit how much one compromised wallet can cost them. Holding different coins under the same recovery phrase still leaves them exposed to the same failure. Separate, independently generated wallets can reduce that concentration, provided their backups are managed securely.
The wider threat is also likely to intensify. The UK’s National Cyber Security Centre assesses that AI will make cyber intrusions more efficient and increase their frequency and intensity. There is no established evidence here that AI caused the Ledger implants, but AI can strengthen the criminal operations surrounding theft, including reconnaissance and social engineering. NCSC assessment.
Users should expect increasingly convincing scams, verify alerts through official channels and never disclose a recovery phrase to someone offering support. As attacks become more capable, keeping all your coins behind one vulnerable point becomes an increasingly costly gamble.
Related coverage
Trezor Responds to Hack Claims, Says There Is No Evidence Its Devices Were Compromised.
Cover image: AI-generated editorial illustration. It does not depict a confirmed tampered device.
