A crypto researcher named @0xJohannes_ says he found a second tampered Ledger hardware wallet at a MediaMarkt store.
He says store records show the stock came from European distributor Aqipa GmbH.
Johannes finds added cables and an LTE module again
Johannes said he got a Ledger from a different MediaMarkt and saw the same physical changes in it as in his first one when he opened the box on video. He said both devices had the same changes, like added cables and an LTE module hidden inside the hardware.
The second device is going to Ledger for analysis, he said.
“I can confirm that the Ledger supply chain is compromised in Europe as well,” Johannes wrote in an Oct. 12 post on X. He called on Ledger to “initiate an immediate product recall to protect users.”
“If you purchased a ledger from anyone other than the official ledger store, make sure to check your device!!” Johannes also said.
More than 9,000 people liked the post, and it was reposted more than 2,000 times.
At first, Johannes thought the devices were returned units being sold as new. The MediaMarkt staff told him that the unit wasn’t a return and that returned Ledgers go straight back to the company that made them.
Johannes said that the supplier is listed in the store’s records as Aqipa GmbH. In 2023, Aqipa started distributing Ledger devices in Germany and Austria. However, his account doesn’t show where any tampering happened.
Johannes wrote that the CTO of Ledger wasn’t sure if Aqipa is directly between Ledger and MediaMarkt.
Johannes says the issue might spread to MediaMarkt and Saturn, which have over 1,000 stores in 11 countries and sell Ledger items. Every store that buys Ledger goods through Aqipa might face the same risk.
Here is the video proof, fresh device, directly from the store, video quality is kinda bad, sorry pic.twitter.com/TbW3cUp4pR
— Johannes (4, 4) (@0xJohannes_) October 12, 2026
Two European purchases echo the CryptoBilis implant pattern
The MediaMarkt reports come as Ledger deals with a separate tampering case involving Southeast Asian reseller CryptoBilis. Thieves stole an estimated $93 million to $94.5 million from Ledger wallets that the reseller sold. Cryptopolitan said that this caused Tether to freeze $10 million in USDT.
On-chain experts found that 315 to 521 wallets were affected.
Mark Karpelès, the founder of Mt. Gox, took apart a Ledger Nano X that he bought in Malaysia. He discovered a cellular modem, an eSIM, and a chip that could read what the screen showed. On October 10, Ledger confirmed one affected user’s device carried an unauthorized hardware implant.
For instance, this part could record a wallet’s recovery words when it is set up and send them over a mobile network. Someone could then copy the wallet and drain it from elsewhere.
Ledger said that its own systems and direct sales channels had not been breached, and it linked every confirmed case to CryptoBilis. After Johannes’s update on October 12, Ledger Support said it again, but it didn’t mention the second MediaMarkt device.
Johannes’s two purchases and the store records from MediaMarkt are the only European evidence so far.
OneKey, a competitor, has already cut ties with CryptoBilis because of the problems. People who bought its products from CryptoBilis are getting free replacements.
If you're reading this, you’re already ahead. Stay there with our newsletter.