Nano

when

A crypto researcher named @0xJohannes_ says he found a second tampered Ledger hardware wallet at a MediaMarkt store.
He says store records show the stock came from European distributor Aqipa GmbH.
<h3 id="span-style-font-weight-400-johannes-finds-added-cables-and-an-lte-module-again-span">Johannes finds added cables and an LTE module again</h3>
Johannes said he got a Ledger from a different MediaMarkt and saw the same physical changes in it as in his first one when he opened the box on video. He said both devices had the same changes, like added cables and an LTE module hidden inside the hardware.
The second device is going to Ledger for analysis, he said.
“I can confirm that the Ledger supply chain is compromised in Europe as well,” Johannes <a href="https://x.com/0xJohannes_/status/2109634513957527974" rel="noopener noreferrer nofollow">wrote</a> in an Oct. 12 post on X. He called on Ledger to “initiate an immediate product recall to protect users.”
“If you purchased a ledger from anyone other than the official ledger store, make sure to check your device!!” Johannes also said.
More than 9,000 people liked the post, and it was reposted more than 2,000 times.
At first, Johannes thought the devices were returned units being sold as new. The MediaMarkt staff told him that the unit wasn’t a return and that returned Ledgers go straight back to the company that made them.
Johannes said that the supplier is listed in the store’s records as Aqipa GmbH. In 2023, Aqipa started distributing Ledger devices in Germany and Austria. However, his account doesn’t show where any tampering happened.
Johannes wrote that the CTO of Ledger wasn’t sure if Aqipa is directly between Ledger and MediaMarkt.
Johannes says the issue might spread to MediaMarkt and Saturn, which have over 1,000 stores in 11 countries and sell Ledger items. Every store that buys Ledger goods through Aqipa might face the same risk.
<blockquote class="twitter-video">
 Here is the video proof, fresh device, directly from the store, video quality is kinda bad, sorry <a href="https://t.co/TbW3cUp4pR" rel="noopener noreferrer nofollow">pic.twitter.com/TbW3cUp4pR</a>
 — Johannes (4, 4) (@0xJohannes_) <a href="https://x.com/0xJohannes_/status/2109634517296148568?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">October 12, 2026</a>
</blockquote>
<h3 id="span-style-font-weight-400-two-european-purchases-echo-the-cryptobilis-implant-pattern-span">Two European purchases echo the CryptoBilis implant pattern</h3>
The MediaMarkt reports come as Ledger deals with a separate tampering case involving Southeast Asian reseller CryptoBilis. Thieves stole an estimated $93 million to $94.5 million from Ledger wallets that the reseller sold. <a href="https://www.cryptopolitan.com/tether-blocks-10m-cryptobilis-ledger/" rel="noopener noreferrer nofollow">Cryptopolitan</a> said that this caused Tether to freeze $10 million in USDT.
On-chain experts found that 315 to 521 wallets were affected.
Mark Karpelès, the founder of Mt. Gox, took apart a Ledger Nano X that he bought in Malaysia. He discovered a cellular modem, an eSIM, and a chip that could read what the screen showed. On October 10, Ledger confirmed one affected user’s device carried an unauthorized hardware implant.
For instance, this part could record a wallet’s recovery words when it is set up and send them over a mobile network. Someone could then copy the wallet and drain it from elsewhere.
Ledger said that its own systems and direct sales channels had not been breached, and it linked every confirmed case to CryptoBilis. After Johannes’s update on October 12, Ledger Support said it again, but it didn’t mention the second MediaMarkt device.
Johannes’s two purchases and the store records from MediaMarkt are the only European evidence so far.
<a href="https://www.cryptopolitan.com/onekey-cut-cryptobilis-ledger-wallet-exploit/" rel="noopener noreferrer nofollow">OneKey</a>, a competitor, has already cut ties with CryptoBilis because of the problems. People who bought its products from CryptoBilis are getting free replacements.
If you're reading this, you’re already ahead. <a href="https://www.cryptopolitan.com/newsletters/?utm_source=cp&amp;utm_medium=web&amp;utm_campaign=inlineAds" rel="noopener noreferrer nofollow">Stay there with our newsletter</a>.

MediaMarkt records tie a second suspect Ledger wallet to distributor Aqipa

Table of Contents

Cryptopolitan_News

Other articles published on Oct 13, 2026

Top Researcher Outlines the Path to a Higher-Priced XRP

473 Million XRP Now Backs Evernorth’s New Nasdaq Listing Under XRPN

What Will Happen to BTC if Trump Loses the US Midterms? (3 AIs Analyze)

South Korea seeks to block 27 crypto websites, including KuCoin and MEXC

Michael Saylor drops bold Bitcoin call ahead of major index review

Metaplanet Plans $328.5M Convertible-Bond Raise for Debt Repayment and Buybacks

Join our free newsletter for daily crypto updates!