A MediaMarkt Ledger may carry an early build of the implant behind Asia's estimated $93.4 million in thefts

The case for a European spread is one buyer's photographs and one investigator's reading of an antenna label ^[8][13]. Johannes, who says he bought the device two weeks ago ^[8], offered two explanations of his own: "Either the device didn't work, or they were waiting for a more widespread usage of the compromised devices," he said ^[11].

By his account the purchase predates the thefts that surfaced in Asia late last week ^[15]. That fits Cointelegraph's description of the implant as appearing to be an earlier version of the one found in CryptoBilis devices ^[9].

Yfarmx's estimate works out to about $198,300 an address ^[14], an average, and one Ledger has not confirmed ^[7]. In our view that makes waiting affordable for an attacker, because each address that eventually empties is worth roughly that much. It also makes Johannes's second explanation untestable until funds move.

Mark Karpeles, the former Mt Gox chief executive whose investigations into the Asian devices helped expose the problem, said the device's antenna marks it as the "Eurasian version" ^[13]. According to the report, that suggests separate implant versions went to regions that use different mobile frequencies ^[13]. Two hardware variants are harder to explain as one modified unit, so we think the evidence leans toward a problem wider than a single reseller.

That lean rests on one device. The simpler account is an isolated unit that reached a MediaMarkt shelf by a path the report does not describe, and our view fails if Ledger or MediaMarkt shows that, if a second unit is opened and carries a different component, or if the antenna label turns out to mean something other than a regional variant. A drained European address would settle it the other way.