A buyer has reported finding a second tampered Ledger hardware wallet purchased from MediaMarkt, and is now calling on the company to recall the affected devices. The device is being sent to Ledger for analysis, according to the buyer, who identified distributor Aqipa as the source of the compromised unit.
The report marks the second confirmed case of tampering linked to MediaMarkt retail stock. Ledger Support maintains that its confirmed tampering cases involve CryptoBilis, a separate distributor. The buyer's account names Aqipa instead, a discrepancy that hasn't been publicly resolved.
What the buyer found
Details of the tampering itself remain limited. The buyer hasn't disclosed exactly what was altered inside the packaging or the device, or when the purchase was made. What is clear is that the wallet was bought through MediaMarkt, a major European electronics retailer, and that the buyer believes it arrived compromised.
The buyer is now pushing for a recall covering the affected Ledger units sold through that channel. That's a significant ask. A recall would require MediaMarkt, Ledger, and the distributor to coordinate on identifying which units are affected — a process that hasn't been announced by any of the parties involved.
The CryptoBilis thread
Ledger's support team has pointed to CryptoBilis as the distributor behind its confirmed tampering cases. That position hasn't changed with this new report. If the buyer is correct that their device came through Aqipa, it raises questions about whether the problem is broader than Ledger has acknowledged.
MediaMarkt hasn't publicly commented on the second device. Aqipa hasn't either. Ledger's stance, as communicated through support channels, remains focused on the CryptoBilis link.
Hardware wallet tampering typically involves someone intercepting a device before it reaches the customer — swapping in a pre-initialized seed phrase or altering packaging so the buyer unknowingly sets up a wallet the attacker already controls. It's a supply-chain problem, not a firmware exploit, which is why the distributor matters so much in these cases.
Why the distributor question matters
If tampered devices entered the retail chain through more than one distributor, the scope of the problem grows. Ledger's public position ties confirmed cases to CryptoBilis. The buyer's claim about Aqipa, if verified, would suggest either a second entry point or a misattribution somewhere in the chain.
Neither possibility has been confirmed. Ledger hasn't said whether it's investigating the Aqipa link specifically, and the company hasn't responded publicly to the recall demand.
For anyone who bought a Ledger through MediaMarkt, the practical advice hasn't changed: verify the device's integrity before transferring funds, check the packaging for signs of tampering, and generate a new seed phrase rather than trusting one that came pre-filled. That last point is the most common failure mode in these cases.
The second device is on its way to Ledger for analysis. That examination should establish whether the tampering is genuine and, if so, what exactly was altered. The results will also inform whether the buyer's call for a recall gains any traction.
Until Ledger publishes its findings, the distributor question — CryptoBilis versus Aqipa — stays open. MediaMarkt customers who've bought Ledger devices in recent months have no official guidance beyond Ledger's existing self-verification instructions.
