X users allege Ledger spyware implants in wallets bought from MediaMarkt and LazMall
X users say tampered Ledger wallets also came from MediaMarkt in Germany and LazMall in the Philippines, beyond the CryptoBilis batch Ledger confirmed. Karpelès has examined pictures of the LazMall unit; the MediaMarkt claim rests on one account.
The Watch · Security desk
Ledger confirmed a limited number of CryptoBilis devices hit October 9; CryptoBilis buyers lost over $86 million; an X user alleges a MediaMarkt implant; Karpelès saw spyware in a LazMall wallet; spyware can record seed phrases unseen by Genuine Check; dozens told their devices are clean.
- Who has to decide decision CryptoBilis devices Ledger confirmed the October 9 incident affected a "limited" number of devices sold by CryptoBilis, claim 8
- What it costs cost CryptoBilis buyers Drained of over $86 million last week, Protos reported, claim 7
- Who's exposed exposure MediaMarkt, German reseller @0xJohannes_ claims a device bought there had a spy implant, claim 9
- Who's exposed exposure The LazMall wallet Karpelès noted an earlier style of spyware, a "manual coil antenna", claim 4
- What's now possible capability Implanted Ledger devices Spyware reads screen output and can record any seed phrase, undetected by Genuine Check, claim 1
- Who's exposed exposure Users who dismantled devices Dozens were told by Karpelès their devices are "clean", claim 5
| Who | How | Kind | Claim |
|---|---|---|---|
| CryptoBilis devices | Ledger confirmed the October 9 incident affected a "limited" number of devices sold by CryptoBilis | decision | 8 |
| CryptoBilis buyers | Drained of over $86 million last week, Protos reported | cost | 7 |
| MediaMarkt, German reseller | @0xJohannes_ claims a device bought there had a spy implant | exposure | 9 |
| The LazMall wallet | Karpelès noted an earlier style of spyware, a "manual coil antenna" | exposure | 4 |
| Implanted Ledger devices | Spyware reads screen output and can record any seed phrase, undetected by Genuine Check | capability | 1 |
| Users who dismantled devices | Dozens were told by Karpelès their devices are "clean" | exposure | 5 |
What happened
- Ledger confirmed that the October 9 incident affected a "limited" number of devices sold by CryptoBilis.
- Mark Karpelès found that the implant reads a device's screen output, can record any seed phrase, and stays undetected by Ledger's Genuine Check.
- Protos reported that Ledger users who bought from CryptoBilis were drained of over $86 million last week.
- The MediaMarkt device did not appear to redirect any funds to an exploiter.
Why it matters
- What doesn't add up contradiction Ledger's confirmation covers CryptoBilis only, while the retail claims name official resellers in Germany and the Philippines, so the confirmed scope and the alleged scope do not match.
- Who's exposed exposure A seed phrase shown on an implanted unit can be captured, and a passing Genuine Check does not rule that out.
- Who has to decide decision Owners deciding whether to open a device have one data point so far: dozens who dismantled theirs were told by Karpelès that the units were clean.
Next story · Science · 2d ago
Ledger asks resellers in seven Asian markets to pull its wallets while it traces the tamperingConfirmed6 publishers
The evidence differs by channel. For CryptoBilis, the Malaysia-based reseller, Ledger itself confirmed an incident [8], and Mark Karpelès helped identify an implant in a Stax model shared by @wentrre, who also bought from CryptoBilis [12]. For LazMall in the Philippines, the support is a set of interior photos from @Us_Chan007 and Karpelès's assessment of them [3]. For MediaMarkt in Germany, it is one X account. @0xJohannes_, a self-described semi-professional airdrop farmer, claimed to have unpacked an implanted unit bought directly from the official German reseller [9].
That makes two named retailers outside CryptoBilis [16], and Protos describes the cases as alleged [6]. The evidence does not show where either unit was altered. A purchase location says where a device was sold.
Ledger's own statement points at reseller practice. The company said: "We are reminding our authorized resellers and distributors to source products only through authorized channels and never to restock returned products." [2]
The LazMall detail matters for a second reason. Protos reports that Karpelès called the implant an earlier style of spyware, a "manual coil antenna" [4]. Describing one unit as an earlier style implies at least two styles exist. In our view that points to more than one version of the implant in circulation. It fits the MediaMarkt user's claim that "there are reported cases in Asia, South America, and now Europe as well" [11], though that claim comes from the same single account.
No loss is attached to the MediaMarkt unit. The owner offered an explanation: "Either the device didn't work or they were waiting for a more widespread usage of the comprised devices." [13] That is speculation from one account. It allows for a dud and for a dormant device, and the published material does not separate the two.
On CryptoBilis ownership, former CEO Arravind Prabu said on X that the firm was acquired earlier this year and that he has stepped down from all operations [14]. He also claimed the company's account is under new management and that former staff signed a confidentiality clause that kept them from disclosing the new ownership [15]. Those are his statements, made in an exchange on X.
What to watch
- Whether Ledger addresses the MediaMarkt and LazMall units and says if they came from authorized stock or from returned products.
- Whether Karpelès or another analyst examines the MediaMarkt device, which so far rests on one X account.
- Any loss tied to a unit bought outside CryptoBilis, since the $86 million figure is attributed to CryptoBilis buyers alone.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Former Mt. Gox CEO Mark Karpelès discovered that spyware implanted in some Ledger devices was being used to read their screen output; it could record any seed phrase while remaining undetected by Ledger's Genuine Check security protocol.
- [2]
Ledger said: "We are reminding our authorized resellers and distributors to source products only through authorized channels and never to restock returned products."
- [3]
X user @Us_Chan007 shared pictures of the interior of a Ledger wallet they bought from official Philippine reseller LazMall.
- [4]
Karpelès noted the LazMall wallet was fitted with an earlier style of spyware in the form of a "manual coil antenna."
- [5]
Dozens of users have dismantled their Ledger devices out of caution and been told by Karpelès that they are "clean."
- [6]
More examples of Ledger wallets being tampered with and fitted with physical spyware have allegedly been identified across Asia, Europe, and South America.
- [7]
Ledger users who bought hardware wallets from Malaysia-based reseller CryptoBilis were drained of over $86 million last week.
- [8]
Ledger confirmed that the incident on October 9 affected a "limited" number of devices sold by CryptoBilis.
- [9]
X user @0xJohannes_, a self-proclaimed semi-professional airdrop farmer, claimed to have unpacked a Ledger device with a spy implant that was bought directly from Ledger's official German reseller MediaMarkt.
- [10]
The MediaMarkt device did not appear to redirect any funds to an exploiter.
- [11]
@0xJohannes_ also claimed that "there are reported cases in Asia, South America, and now Europe as well."
- [12]
Karpelès helped identify spyware implanted in one of Ledger's Stax models shared by X user @wentrre, who had also bought from CryptoBilis.
- [13]
On the MediaMarkt device not redirecting funds, @0xJohannes_ said: "Either the device didn't work or they were waiting for a more widespread usage of the comprised devices."
- [14]
Former CryptoBilis CEO Arravind Prabu revealed in an exchange on X that the firm was acquired earlier this year and that he has stepped down from all operations.
- [15]
Prabu claims the CryptoBilis account is under new management and that former staff signed a confidentiality clause that meant they could not reveal the company was under new ownership.
- [16]
Two named retailers outside CryptoBilis, MediaMarkt and LazMall, are alleged sources of tampered units in the report.
Sources
2 independent publishers whose own reporting we read for this story.
- bankless.comLedger Spyware Scare Spreads Across Asia and Europe
1 article · October 13, 2026
- protos.comLedger spyware scare spreads beyond Southeast Asia
1 article · October 12, 2026
Topics and entities
Topics
- Crypto supply chain attacks
- Hardware Wallet Security