Researcher says MediaMarkt records name Aqipa as supplier of a second modified Ledger

The physical half of the claim rests on a video Johannes filmed while opening the box ^[8]. The locational half is thinner. A supplier line in a retailer's records identifies who delivered the stock to the shelf; it does not identify who added the cables, and Johannes's own account does not show where any tampering happened ^[6].

There are three ways this resolves, and the sources do not let us choose between the first two. The modification could have entered upstream of Aqipa, which would tie the MediaMarkt units to whatever produced the CryptoBilis cases. It could have entered at or after Aqipa inside Europe, which is what Johannes asserts. He wrote in an Oct. 12 post on X: "I can confirm that the Ledger supply chain is compromised in Europe as well." ^[10] Or the units could be resealed returns, his first guess before staff ruled it out ^[12].

In our view the first two are likelier than the third. Two units from two stores, plus a staff statement that the unit was not a return, make a pattern that one resealed return cannot produce. We hold that loosely, because the staff statement reaches us through Johannes and analysis of the second device is still ahead ^[11]. If MediaMarkt's account of its returns handling turned out to be wrong, the third reading would be back in play.

The scale gap between the two cases is large. The European evidence is two purchases and the store records ^[5], against 315 to 521 affected wallets on the CryptoBilis side, according to on-chain experts ^[3]. Those cases carry estimated thefts of $93 million to $94.5 million ^[2], or roughly $178,500 to $300,000 per wallet ^[7].

The part Mark Karpelès found in a Nano X he bought in Malaysia (a cellular modem, an eSIM and a chip that could read what the screen showed) ^[4] could record a wallet's recovery words at setup and send them over a mobile network ^[16].