Ledger has confirmed that a hidden hardware implant was present in devices affected by a $93.4 million exploit targeting its wallets. While the company initially attributed the attack to CryptoBilis, an authorized reseller in Asia, social media reports now suggest compromised devices may have reached European retailers.
A user identified as Johannes on X reported purchasing a tampered Ledger wallet from Mediamarkt, a German retail chain operating across multiple European countries including Italy, Spain, Turkey, Poland, Austria, and the Netherlands. The device contained an earlier version of the hardware implant that, unlike more advanced variants, did not hide itself behind the device screen.
Johannes noted that despite the wallet being compromised, it did not transfer his funds to the exploiter, speculating the attack may have failed or the attacker was waiting for wider device deployment. Former Mt. Gox CEO Mark Karpeles identified the implant's antenna as an "Eurasian version," suggesting different implant variants designed for regional mobile frequencies.
A significant concern is that all tampered devices passed Ledger's software security checks, giving users false confidence in their wallets' integrity. Johannes recommended that Ledger owners who purchased devices from resellers physically inspect them and not rely solely on software verification.
Ledger stated in its latest update that confirmed cases remain limited to devices sold through CryptoBilis and encouraged affected users to contact Ledger Support through official channels and file complaints with local law enforcement. The company said it is reviewing authorized reseller controls and advancing hardware protections in cooperation with authorities.
