Buyer Reports Second Tampered Ledger From MediaMarkt, Calls for Recall

A Ledger buyer posting as 0xJohannes_ said on Oct. 12 that a second wallet bought that day from a different MediaMarkt store contained the same unauthorized hardware as his first, and called for an immediate product recall.

Ledger Support, in a reply posted after the buyer’s update, maintained that “all confirmed cases involve devices sold through the Southeast Asia reseller CryptoBilis.” It said Ledger’s systems and direct sales channels remained unaffected. The reply did not address the second MediaMarkt device.

Johannes said the modifications included additional cables and what he described as an LTE module. He also posted what he called an unboxing video, describing the wallet as a “fresh device, directly from the store.”

The account follows his first European-device report on Oct. 11. In that initial post, Johannes said no funds had been transferred to an exploiter from the wallet—a distinction from the fund-draining cases Ledger has confirmed.

Buyer Names a Distributor

Johannes said store records identified Aqipa GmbH as the source of the inventory. He also said a MediaMarkt employee told him the second device was not a return and that returned Ledgers are sent back to the manufacturer rather than resold.

Aqipa announced a Ledger distribution partnership in 2023, initially covering Germany and Austria. The supply route for this particular device, however, remains the buyer’s account; it does not establish where any tampering occurred.

The MediaMarktSaturn newsroom and Aqipa pressroom carried no statement addressing the second device at publication.

Ledger’s Oct. 11 update said it was reviewing authorized-reseller controls and reminded distributors and resellers never to restock returned products. That statement limited its confirmed-case assessment to the fund-draining incident disclosed on Oct. 9.

Software Checks Have Limits

Ledger’s own security documentation says its Genuine Check verifies the device’s secure element, but cannot detect unauthorized physical modifications such as spying implants if that chip remains intact. Passing the check therefore does not rule out added hardware.

Ledger’s incident-specific instructions remain directed at CryptoBilis buyers: do not initialize unused devices; if already set up, move to a new seed on a device from Ledger. Its Oct. 12 support reply also directed buyers, wherever they purchased their device, to a hardware-inspection tutorial or official support.

Johannes said he was sending the second device to Ledger for analysis.