Quick answer: A buyer posting as 0xJohannes_ said on Oct. 12, 2026, that a second Ledger wallet bought at a different MediaMarkt store had extra cables and an LTE module, The Defiant reported. Ledger has not confirmed the European claims and says all confirmed cases involve the CryptoBilis reseller.
Ledger MediaMarkt buyers in Europe now face an uncomfortable question. On Monday, Oct. 12, 2026, a buyer posting on X as 0xJohannes_ said a second Ledger wallet, bought that day at a different MediaMarkt store, contained the same unauthorized hardware as his first one, The Defiant reported. He described extra cables and an LTE module, and he called for an immediate recall.
However, Ledger has not confirmed the European reports. Its support team still says all confirmed cases involve devices sold through CryptoBilis, a reseller in Southeast Asia.
What did the buyer find in the Ledger MediaMarkt wallets?
The first report came on Oct. 11, 2026. Johannes said a Ledger Nano X bought in store at MediaMarkt about two weeks earlier showed internal wiring that genuine units don’t have, according to Newisty. No funds had moved from that wallet.
Then, on Oct. 12, he bought a second device at another MediaMarkt store and filmed the unboxing. He said the changes matched the first unit “in the exact same manner.” He also said a store employee told him the wallet was not a return, and that store records named the distributor Aqipa GmbH as the source of the stock.
Aqipa, based in Austria, lists Ledger among its brands and announced a Ledger distribution deal for Germany and Austria in 2023. Still, the supply route is only the buyer’s account. It doesn’t show where any tampering happened, as CoinScreamer stressed. Johannes said he sent the first device to Mark Karpelès and is sending the second to Ledger.
Is this linked to the $86 million CryptoBilis theft?
Not yet. On Oct. 9, Ledger began investigating losses among customers who bought from CryptoBilis in Indonesia, Malaysia and the Philippines. On-chain investigators put those losses at more than $86 million, as we covered in our Ledger CryptoBilis theft report. Ledger later confirmed an unauthorized implant in at least one affected device.
In its Oct. 11 update, Ledger said every confirmed case tied to that theft involved CryptoBilis. It added that its own systems and direct sales were unaffected, and that it was reviewing authorized-reseller controls. By contrast, nobody has drained the MediaMarkt devices, so the European claims remain a separate, unverified report.
How big could the Ledger MediaMarkt exposure be?
Nobody knows yet. MediaMarkt and Saturn run about 1,070 stores in 11 countries. Yet that is the group’s footprint, not a count of affected stores. So far, one buyer has publicly reported just two devices. At publication, neither MediaMarktSaturn nor Aqipa had made a public statement, per The Defiant.
What should Ledger owners do right now?
First, don’t panic if you bought directly from Ledger. Ledger says its direct channel is unaffected. Next, follow these steps if you bought from any retailer:
- Don’t set up an unused device yet. Ledger told CryptoBilis buyers not to initialize new units, and the same caution is sensible while this is checked.
- Inspect the hardware. Ledger Support pointed all buyers to its hardware-inspection tutorial on Oct. 12. Our guide on how to check if a hardware wallet is tampered walks through it.
- Don’t rely on Genuine Check alone. Ledger’s own documentation says it verifies the secure chip but can’t detect added hardware, such as an extra radio module.
- Never use a pre-filled recovery phrase. If in doubt, move funds to a new phrase on a device bought directly from the maker. Our self-custody setup guide explains how.
Also, scammers will likely send fake “recall” emails, so read how to spot crypto scams before you click anything.
What it means for the hardware wallet market
Hardware wallets sell on one promise: keys stay offline. So even unconfirmed retail claims can push buyers toward direct-only purchases and pressure distributors to explain stock handling. Meanwhile, the forensic results from the two MediaMarkt units will decide whether this becomes a broader recall story.
Ledger MediaMarkt FAQ
Has Ledger confirmed tampered wallets at MediaMarkt?
No. As of Oct. 13, 2026, Ledger says all confirmed cases involve devices sold through CryptoBilis in Southeast Asia. Its Oct. 12 support reply did not address the second MediaMarkt device.
Were any funds stolen from the MediaMarkt devices?
No funds were reported stolen. The buyer said no money moved from his first device, and he opened the second at unboxing, before setup.
Is it safe to buy a Ledger from a retail store?
Buying directly from Ledger is the safest route while the claims are checked. If you buy elsewhere, inspect the device and never accept a recovery phrase that came with it.
Can Ledger Genuine Check detect a hardware implant?
No. Ledger’s documentation says Genuine Check verifies the secure element chip but cannot detect physical changes such as added spying hardware if that chip is intact.
Who is Aqipa GmbH?
Aqipa is an Austrian electronics distributor that lists Ledger among its brands. The buyer said store records named it as the source of the stock, but that hasn’t been independently confirmed.
Not financial advice. Always DYOR (do your own research) before acting on any crypto news.
Sources
- The Defiant: Buyer Reports Second Tampered Ledger From MediaMarkt, Calls for Recall (Oct. 12, 2026)
- CoinScreamer: Ledger Wallet Implants Reported at Two MediaMarkt Stores (Oct. 12, 2026)
- Newisty: European Reseller MediaMarkt Linked to Implanted Ledger Wallet (Oct. 13, 2026)
- Aqipa: company history and brand list
- Decrypt: Ledger probes $87M theft tied to wallet reseller (Oct. 9, 2026)
