Key Notes
- A buyer says wallets purchased from two different MediaMarkt stores contained similar extra cables and an LTE module, and published a video of the second purchase.
- The retailer’s roughly 1,070-store network is not a count of affected locations, and the devices’ complete supply-chain history remains unverified.
- Ledger previously confirmed an implant in a CryptoBilis customer’s device, but that confirmation does not establish the scope of the separate European reports.
A Ledger buyer says he found similar unauthorized hardware inside two wallets purchased from different MediaMarkt stores, adding a second European purchase account to an investigation that has already prompted Ledger to confirm an implant in one affected customer’s device.
The buyer, posting as Johannes on X, reported on October 12 that he recorded the second device’s unboxing and found additional cables and what he identified as an LTE module. He said the modifications matched those in his first purchase, which CoinScreamer covered in its earlier report.
The account raises questions about how altered devices could reach retail shelves. It does not establish that all MediaMarkt or Saturn stock is compromised, or that these two devices explain the broader cryptocurrency theft reports. The buyer published a separate video accompanying his account:
Here is the video proof, fresh device, directly from the store, video quality is kinda bad, sorry
— Johannes (@0xJohannes_) October 12, 2026
Two Purchases, a Wider Distribution Question
Johannes said he initially suspected that an altered device might have been returned to a store and resold as new. According to his account, a MediaMarkt employee told him the second wallet was not a return and that returned Ledger products were sent back to the manufacturer rather than placed on sale again.
He also said store records identified Aqipa GmbH as the source of the inventory. He described uncertainty about the distributor’s precise role between Ledger and MediaMarkt, however. His account alone does not independently establish the devices’ complete route through the supply chain or where any modification occurred.
The buyer said he had sent the first wallet to a researcher and was sending the second to Ledger for analysis. Those examinations could help determine whether both units contain functioning implants, how the additional components operate and whether their designs share a common origin. CoinScreamer has not independently examined the devices or authenticated their purchase and distribution records.
Johannes called for a recall and warned that the problem could extend across MediaMarkt and Saturn. Their parent company describes a retail network of about 1,070 stores in 11 countries. That figure describes the group’s footprint, rather than the number of stores known to have received altered wallets.
Ledger’s reseller directory lists MediaMarkt DE and Saturn as authorized online retailers in Germany. The listings do not authenticate a particular physical device or resolve the provenance of the buyer’s purchases. There is no basis in the account to conclude that staff at either retailer or the named distributor participated in tampering.
What Ledger Has Already Confirmed
The European account follows a separate investigation involving wallets sold through CryptoBilis. On October 10, Ledger Support confirmed an unauthorized hardware implant in one affected user’s device. CryptoBilis suspended all hardware-wallet sales while the investigation continued, as detailed in our company update.
In an October 11 statement, Ledger said all confirmed cases related specifically to the October 9 draining incident involved CryptoBilis devices. It described an unspecified, limited volume of impacted devices and said its own systems and direct sales remained unaffected. That update predates the new two-store report and does not independently confirm the MediaMarkt purchases.
Earlier reports put suspected losses above $86 million, based on analyst Specter’s examination of transactions and user accounts. As our initial coverage explained, the estimate was preliminary. It should not be treated as an audited loss total, a verified count of victims or proof that every reported theft resulted from an implanted device.
Separate Tibane Labs research documented modified Nano X wallets obtained through Japanese marketplaces. Those specimens provide technical context but do not establish a common source with the CryptoBilis investigation or the European purchases. CryptoBilis’s former founders have also issued a handover statement; it does not determine who altered any device.
A Genuine Check Has Limits
Ledger’s official inspection guide explains an important distinction: Genuine Check authenticates the original secure element, but cannot detect unauthorized physical modifications or spying implants if that component remains intact. A successful check therefore does not establish that every other component is untouched.
The guide includes model-specific internal reference images and cautions about damage during inspection. Opening a device can expose sensitive components to electrostatic discharge, and damage can affect warranty coverage. Owners should follow the instructions for their particular model rather than assume that every Ledger wallet can be safely opened in the same way.
Ledger’s published warning to CryptoBilis customers is more specific: do not initialize an unused device bought from that seller; if it has already been set up, move funds to a trusted replacement using a newly generated recovery phrase. Restoring the old phrase on different hardware would preserve the same keys. Questions about a potentially altered device should go through official support, without disclosing recovery words.
For the MediaMarkt report, the outstanding issue is the devices’ provenance and forensic examination. A buyer’s account of two similar modifications warrants investigation, while the extent of any affected inventory remains unestablished.
Disclaimer: CoinScreamer is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and market insights on digital assets and related technologies. NuvexMedia LLC invests in and collaborates with companies across the digital asset, blockchain, and technology sectors. These relationships do not influence CoinScreamer’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2025 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
