Key Notes
- Mark Karpelès says a Ledger Flex bought at Singapore Airport contained an implant after its owner submitted it for inspection.
- Ben Yorke says he never plugged in the device, and the cited posts do not report a theft from that wallet.
- A separate European retailer watchlist remains speculative and does not establish that all named stores received modified devices.
Mark Karpelès says he found an unauthorized implant inside a Ledger Flex bought at Singapore Airport, adding a new device inspection to the widening hardware-wallet investigation. The former Mt. Gox chief published photographs and a teardown video after the owner sent him the unused wallet because of suspicious marks on its casing.
Karpelès reported the finding on October 13. The owner, Ben Yorke, had said he bought the roughly $300 device during the summer and had never plugged it in. Yorke identified the airport retailer as Metapod in his account.
The cited posts do not report a theft from Yorke’s wallet. They describe a suspicious device submitted for examination before use, rather than a confirmed loss of funds. CoinScreamer has not physically inspected the unit or independently verified its purchase records and complete distribution history.
Ledger Flex sold at Singapore Airport confirmed to contain a spy implant!
— Mark Karpelès (@MagicalTux) October 13, 2026
What the Flex Inspection Shows
In the 18-minute inspection video, Karpelès opens the casing and identifies an additional board in the device’s lower section. He points to an antenna, cellular components and modified connections associated with the display and power supply, comparing the assembly with another Flex.
His examination indicates added hardware, but the analysis is still developing. Karpelès says he intends to extract and examine the module’s firmware to determine its precise behavior. He does not demonstrate a completed extraction of Yorke’s recovery phrase or establish everything the module might collect.
That separates the physical finding from the broader attribution questions. The video does not determine who modified the wallet, where it was altered or whether the airport purchase shares a source with devices reported in Europe or through CryptoBilis.
European Retailer List Remains a Watchlist
A separate October 12 update from CryptoQuant contributor Darkfost expanded a list of retailers he believes warrant scrutiny. He based the additions on possible distribution links involving Aqipa GmbH following further MediaMarkt device reports.
The European section names MediaMarkt in Germany and Austria, Saturn in Germany, Fnac/Darty and Boulanger in France, and MediaMarkt Suisse in Switzerland. Its entries describe potential exposure, rather than confirmed findings of altered inventory at every named business.
Darkfost explicitly says the wider list is speculative. His reference to discoveries involving MediaMarkt and CryptoBilis should also be read with its sources in mind: the MediaMarkt cases are public buyer and researcher reports, while Ledger has separately confirmed an implant in an affected CryptoBilis customer’s device.
CoinScreamer’s two-store report covered a buyer’s account of similar added hardware in wallets purchased from different MediaMarkt locations. That account does not establish that all MediaMarkt or Saturn devices are modified, or that store staff participated in tampering.
The distribution relationship itself has a documented history. Aqipa’s 2023 announcement introduced its Ledger partnership for Germany and Austria. It supports the existence of that commercial relationship, but does not prove that a particular suspect device passed through Aqipa or identify a point of compromise.
The airport report and the European watchlist therefore raise related supply-chain questions without establishing one common operation. Neither the retailer list nor the distribution announcement proves wrongdoing by the named stores or distributor.
Ledger’s Confirmation Covers a Specific Theft Investigation
Ledger’s October 11 company statement said all cases it had confirmed in the draining incident disclosed on October 9 involved devices sold through CryptoBilis. It described the impacted volume as limited and said its own systems and direct sales channels remained unaffected.
That statement predates Karpelès’s airport finding and does not independently authenticate it. As our earlier coverage explains, the manufacturer’s confirmation concerns an examined customer device; it does not establish the cause of every reported theft or the status of every retail channel.
Ledger also said CryptoBilis had ceased hardware-wallet sales and reminded distributors not to return previously sold products to stock. The company’s instructions for CryptoBilis buyers were to avoid initializing unused devices and, if already set up, move to a newly generated seed on a device obtained from Ledger.
Authenticity and Physical Integrity Are Different Checks
Ledger’s security team explains in its threat model that Genuine Check verifies the secure element’s cryptographic identity. It cannot detect an added spying implant when that original component remains intact.
A modified genuine device is therefore a different problem from a wholly counterfeit wallet. Passing the authentication check does not establish that every component or every stage of the device’s journey to the buyer was untouched.
The manufacturer’s buying guidance tells customers not to use a device whose packaging appears opened, altered or compromised, and to contact official support. Recovery words should never be entered into a website or disclosed to someone offering an inspection.
The outstanding questions now concern the airport unit’s provenance, the implant’s firmware and whether investigators can connect separate discoveries. Karpelès’s teardown adds a concrete examination to that record, while the broader retailer list remains a hypothesis requiring evidence.
Disclaimer: CoinScreamer is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and market insights on digital assets and related technologies. NuvexMedia LLC invests in and collaborates with companies across the digital asset, blockchain, and technology sectors. These relationships do not influence CoinScreamer’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2025 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
