Ledger's October 13 update on its hardware implant probe named only one source: CryptoBilis, a Southeast Asian reseller. The company confirmed on October 10 that a signer bought from CryptoBilis contained an unauthorized hardware implant. According to Ledger Donjon, the implant reads the 24-word recovery phrase off the screen during setup and sends it out over a cellular connection.
Within minutes of the update, users pushed back, saying tampered devices turned up at MediaMarkt, a major European electronics chain. Ledger says it's reviewing those reports but hasn't named any retailer beyond CryptoBilis. That gap between what users are claiming and what Ledger will confirm is the story right now.
What the implant actually does
This isn't a supply-chain rumor pulled from a Telegram group. Ledger Donjon, the company's own security research unit, described the attack. The chip sits on the device and watches the screen as the recovery phrase is displayed during setup. It then transmits those 24 words over a cellular link. Once someone has that phrase, the wallet is gone.
Ledger's Genuine Check — the tool owners use to verify a device is authentic — checks the security chip. It doesn't check every component around that chip. A hidden spy chip can pass the check. That's the part owners are struggling with.
The MediaMarkt claims Ledger won't confirm
One user said a second device, bought from a different MediaMarkt store, had the same extra cables and cellular module. That user shared an unboxing video. The same person said store records traced the stock to Aqipa, a European electronics distributor, and sent the device to Ledger for analysis.
Ledger hasn't confirmed a single case outside CryptoBilis. It says it's looking into reports of implants in other signers and locations, but so far it has named no other retailer. Until that changes, the MediaMarkt claims stay in the unverified column. The unboxing video is evidence of something, but it isn't a company admission.
Money already gone
One trader reportedly lost $6.6 million in Bitcoin after buying through the reseller. Ledger hasn't said how many users lost funds or what the total value is. Its update asks drained users to contact Support and file a police report. It doesn't address reimbursement.
That silence matters. Filing a police report is a paper trail, not a recovery plan. For anyone who bought through CryptoBilis, Ledger's actual guidance is blunt: move your funds to a new signer with a fresh recovery phrase. Do it now, not after you finish reading.
Weighing a wallet to catch a spy chip
Some owners have started weighing their hardware wallets to spot tampering. A matching weight proves very little — a well-hidden extra chip can land within normal manufacturing variance. It's a sign of how little trust there is in the verification tools right now.
Ledger also repeated its standard warning: it will never call users, message them directly, or ask for a recovery phrase. Anyone doing any of those things is not Ledger.
The next concrete step is Ledger's review of the non-CryptoBilis reports. The company hasn't given a date for when that review will finish, and it hasn't said whether Aqipa or MediaMarkt will be named. Until it does, buyers at those stores have no official answer on whether their device is clean.
