SecurityIndependently confirmed2 publishers2 min readPublished Updated
X users allege Ledger spyware implants in wallets bought from MediaMarkt and LazMall
X users say tampered Ledger wallets also came from MediaMarkt in Germany and LazMall in the Philippines, beyond the CryptoBilis batch Ledger confirmed. Karpelès has examined pictures of the LazMall unit; the MediaMarkt claim rests on one account.
The Watch · Security desk
Map: Protos reports CryptoBilis buyers were drained of over $86 million; Ledger confirmed a limited number of CryptoBilis devices; an X user claims a MediaMarkt unit had a spy implant; Karpelès noted spyware in a LazMall wallet; spyware can remain undetected by Genuine Check.
- cost CryptoBilis buyers Drained of over $86 million last week, Protos reported, claim 7
- decision Ledger Confirmed the October 9 incident affected a "limited" number of devices sold by CryptoBilis, claim 8
- exposure MediaMarkt, German reseller @0xJohannes_ claims a device bought there had a spy implant, claim 9
- exposure LazMall, Philippine reseller @Us_Chan007 shared pictures of the interior of a Ledger wallet bought there, claim 3
- exposure The LazMall wallet Karpelès noted an earlier style of spyware, a "manual coil antenna", claim 4
- capability Implanted Ledger devices Spyware reads screen output, can record any seed phrase, undetected by Genuine Check, claim 1
| Who | How | Kind | Claim |
|---|---|---|---|
| CryptoBilis buyers | Drained of over $86 million last week, Protos reported | cost | 7 |
| Ledger | Confirmed the October 9 incident affected a "limited" number of devices sold by CryptoBilis | decision | 8 |
| MediaMarkt, German reseller | @0xJohannes_ claims a device bought there had a spy implant | exposure | 9 |
| LazMall, Philippine reseller | @Us_Chan007 shared pictures of the interior of a Ledger wallet bought there | exposure | 3 |
| The LazMall wallet | Karpelès noted an earlier style of spyware, a "manual coil antenna" | exposure | 4 |
| Implanted Ledger devices | Spyware reads screen output, can record any seed phrase, undetected by Genuine Check | capability | 1 |
What happened
- Ledger confirmed that the October 9 incident affected a "limited" number of devices sold by CryptoBilis.
- Mark Karpelès found that the implant reads a device's screen output, can record any seed phrase, and stays undetected by Ledger's Genuine Check.
- Protos reported that Ledger users who bought from CryptoBilis were drained of over $86 million last week.
- The MediaMarkt device did not appear to redirect any funds to an exploiter.
Why it matters
- contradiction Ledger's confirmation covers CryptoBilis only, while the retail claims name official resellers in Germany and the Philippines, so the confirmed scope and the alleged scope do not match.
- exposure A seed phrase shown on an implanted unit can be captured, and a passing Genuine Check does not rule that out.
- decision Owners deciding whether to open a device have one data point so far: dozens who dismantled theirs were told by Karpelès that the units were clean.
The evidence differs by channel. For CryptoBilis, the Malaysia-based reseller, Ledger itself confirmed an incident [8], and Mark Karpelès helped identify an implant in a Stax model shared by @wentrre, who also bought from CryptoBilis [12]. For LazMall in the Philippines, the support is a set of interior photos from @Us_Chan007 and Karpelès's assessment of them [3]. For MediaMarkt in Germany, it is one X account. @0xJohannes_, a self-described semi-professional airdrop farmer, claimed to have unpacked an implanted unit bought directly from the official German reseller [9].
That makes two named retailers outside CryptoBilis [16], and Protos describes the cases as alleged [6]. The evidence does not show where either unit was altered. A purchase location says where a device was sold.
Ledger's own statement points at reseller practice. The company said: "We are reminding our authorized resellers and distributors to source products only through authorized channels and never to restock returned products." [2]
The LazMall detail matters for a second reason. Protos reports that Karpelès called the implant an earlier style of spyware, a "manual coil antenna" [4]. Describing one unit as an earlier style implies at least two styles exist. In our view that points to more than one version of the implant in circulation. It fits the MediaMarkt user's claim that "there are reported cases in Asia, South America, and now Europe as well" [11], though that claim comes from the same single account.
No loss is attached to the MediaMarkt unit. The owner offered an explanation: "Either the device didn't work or they were waiting for a more widespread usage of the comprised devices." [13] That is speculation from one account. It allows for a dud and for a dormant device, and the published material does not separate the two.
On CryptoBilis ownership, former CEO Arravind Prabu said on X that the firm was acquired earlier this year and that he has stepped down from all operations [14]. He also claimed the company's account is under new management and that former staff signed a confidentiality clause that kept them from disclosing the new ownership [15]. Those are his statements, made in an exchange on X.
What to watch
- Whether Ledger addresses the MediaMarkt and LazMall units and says if they came from authorized stock or from returned products.
- Whether Karpelès or another analyst examines the MediaMarkt device, which so far rests on one X account.
- Any loss tied to a unit bought outside CryptoBilis, since the $86 million figure is attributed to CryptoBilis buyers alone.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence50
- Adoption
- Insufficient
- Hype gap+15
- Incentives
- Insufficient
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Former Mt. Gox CEO Mark Karpelès discovered that spyware implanted in some Ledger devices was being used to read their screen output; it could record any seed phrase while remaining undetected by Ledger's Genuine Check security protocol.
ReportedSupportedSource: Protos, on Karpelès's findings2 sources— create a free account to open themView cited source - [2]
Ledger said: "We are reminding our authorized resellers and distributors to source products only through authorized channels and never to restock returned products."
ReportedSupportedSource: Ledger, as reported by Protos2 sources— create a free account to open themView cited source - [3]
X user @Us_Chan007 shared pictures of the interior of a Ledger wallet they bought from official Philippine reseller LazMall.
- [4]
Karpelès noted the LazMall wallet was fitted with an earlier style of spyware in the form of a "manual coil antenna."
- [5]
Dozens of users have dismantled their Ledger devices out of caution and been told by Karpelès that they are "clean."
- [6]
More examples of Ledger wallets being tampered with and fitted with physical spyware have allegedly been identified across Asia, Europe, and South America.
- [7]
Ledger users who bought hardware wallets from Malaysia-based reseller CryptoBilis were drained of over $86 million last week.
- [8]
Ledger confirmed that the incident on October 9 affected a "limited" number of devices sold by CryptoBilis.
ReportedContestedSource: Ledger, as reported by Protos2 sources— create a free account to open themView cited source - [9]
X user @0xJohannes_, a self-proclaimed semi-professional airdrop farmer, claimed to have unpacked a Ledger device with a spy implant that was bought directly from Ledger's official German reseller MediaMarkt.
ReportedContestedSource: @0xJohannes_ on X, as reported by Protos2 sources— create a free account to open themView cited source - [10]
The MediaMarkt device did not appear to redirect any funds to an exploiter.
ReportedContestedSource: Protos, citing @0xJohannes_2 sources— create a free account to open themView cited source - [11]
@0xJohannes_ also claimed that "there are reported cases in Asia, South America, and now Europe as well."
ReportedContestedSource: @0xJohannes_ on X, as reported by Protos2 sources— create a free account to open themView cited source - [12]
Karpelès helped identify spyware implanted in one of Ledger's Stax models shared by X user @wentrre, who had also bought from CryptoBilis.
- [13]
On the MediaMarkt device not redirecting funds, @0xJohannes_ said: "Either the device didn't work or they were waiting for a more widespread usage of the comprised devices."
ReportedContestedSource: @0xJohannes_ on X, as reported by Protos2 sources— create a free account to open themView cited source - [14]
Former CryptoBilis CEO Arravind Prabu revealed in an exchange on X that the firm was acquired earlier this year and that he has stepped down from all operations.
- [15]
Prabu claims the CryptoBilis account is under new management and that former staff signed a confidentiality clause that meant they could not reveal the company was under new ownership.
- [16]
Two named retailers outside CryptoBilis, MediaMarkt and LazMall, are alleged sources of tampered units in the report.
Sources
2 independent publishers whose own reporting we read for this story.
- bankless.comLedger Spyware Scare Spreads Across Asia and Europe
1 article · October 13, 2026
- Ledger spyware scare spreads beyond Southeast Asia
protos.com
1 article · October 12, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Crypto supply chain attacksFollow
- Hardware Wallet SecurityFollow