A new community report has raised concerns that a Ledger device purchased from a MediaMarkt store in Europe may show signs of physical modification. The report arrives while Ledger is investigating a separate, confirmed incident involving devices sold by Southeast Asian reseller CryptoBilis. The two claims should not be treated as the same case: Ledger has confirmed an unauthorized hardware implant in at least one affected CryptoBilis device, but it has not publicly confirmed that the MediaMarkt unit is connected to that incident.
Key points
- An X user posted photographs of a Ledger device said to have been bought in person from an authorized European reseller.
- The user claimed the opened device contained cables and components that appeared unusual.
- Ledger has not confirmed that the European unit was tampered with or linked to the CryptoBilis investigation.
- Ledger says it has no indication that its security infrastructure, systems or services were compromised.
- Buyers should verify the seller, inspect the package and device, initialize it themselves, and never use a recovery phrase supplied by anyone else.
What was reported in Europe?
On October 11, 2026, an X account using the name Johannes posted photographs of an opened Ledger device and said it had been purchased in-store from an official reseller in Europe. The post identified MediaMarkt and argued that the visible cables and internal parts did not match a standard device. The user also said no funds had been lost from that unit at the time of the report.
The photographs prompted rapid discussion because MediaMarkt operates across Europe and is listed by Ledger as an authorized retail partner in some markets. That status, however, does not establish that the photographed unit was modified, where in the supply chain any modification occurred, or whether the device shown is connected to the Southeast Asian incident.
What has Ledger actually confirmed?
Ledger's confirmed statement concerns the investigation into users who bought devices from CryptoBilis in Southeast Asia. The company said one examined device contained an unauthorized hardware implant. It is contacting affected users, working with relevant authorities and continuing to investigate the scope of the incident.
Ledger has also stated that it has no indication its own security infrastructure, systems or services were compromised. That distinction matters. A supply-chain attack involving a physically modified unit is different from a breach of Ledger's central systems or a universal vulnerability affecting every Ledger device.
As of this article's publication, Ledger has not publicly confirmed that the unit shown in the MediaMarkt report contains a malicious implant or that it belongs to the same campaign. Readers should therefore treat the European report as a lead under investigation, not a settled conclusion.
What does this mean for buyers?
An authorized seller reduces risk, but it cannot replace checks performed at setup. The most important signals are how the device behaves when first powered on and whether the user controls the creation of the recovery phrase from the beginning.
A legitimate new hardware wallet should allow the owner to initialize it as a new device. The recovery words must be generated on the hardware wallet itself during setup. They must never arrive preprinted in the box, appear in an email or website, or be requested by support staff. If a package appears opened, resealed, damaged or inconsistent with official product information, stop before entering or transferring any assets.
Ledger's Genuine Check can verify cryptographic authenticity of the Secure Element, but physical supply-chain reports show why buyers should also consider packaging condition, seller identity and device behavior rather than relying on a single signal.
A practical safety checklist
- Confirm the exact seller. On marketplaces, the platform name and the seller name may be different. Keep the invoice and order details.
- Inspect the package before opening. Photograph any damaged seal, unexpected label, cut, glue mark or sign of resealing.
- Initialize as a new device. Never use recovery words included in the package or supplied by another person.
- Run the official Genuine Check. Use the current official Ledger application obtained from Ledger's verified website.
- Start with a small transfer. Verify the receiving address on the hardware wallet screen, send a small amount, and confirm normal operation before moving a larger balance.
- Stop if anything looks wrong. Do not dismantle the device unless instructed by official support; opening it can damage the unit and complicate evidence or warranty handling.
- Ignore unsolicited support messages. Ledger and SIAMBC will never need your 24-word recovery phrase.
What SIAMBC customers should know
The MediaMarkt report and the CryptoBilis investigation have no known connection to SIAMBC inventory. SIAMBC sources Ledger products through controlled commercial channels and maintains purchase and inventory records for products sold in Thailand. There have been no reported cases of this type involving Ledger devices supplied by SIAMBC.
If you bought a Ledger from SIAMBC and notice unusual packaging, unexpected setup behavior or any request for recovery words, do not transfer assets. Keep the device and packaging unchanged and contact SIAMBC with your order number so the team can verify the product history and provide next steps.
Bottom line
The MediaMarkt claim deserves attention, but it is not yet an official confirmation that the CryptoBilis incident has spread to Europe. The responsible approach is to follow Ledger's investigation, avoid amplifying unverified conclusions, and apply the same careful setup process to every hardware wallet: verify the source, initialize it yourself, read the device screen, and protect the recovery phrase offline.
Information status: October 13, 2026. This article will be revised if Ledger or the relevant retailer publishes a confirmed technical finding.
Share:
Ledger Confirms Hardware Implant in CryptoBilis Device: What Users Should Know