ScienceNot yet confirmed elsewhere1 publisher2 min readPublished
Researcher reports a Ledger bought in Europe that appears to carry a hardware implant
Ledger said in its October 11 update that every confirmed case in the October 9 draining incident involved devices sold by CryptoBilis. It has not tied a researcher's possibly implanted European device to that investigation.
The Scientist · Science desk
What happened
- Security researcher Johannes, posting as @0xJohannes_, said he bought the device about two weeks earlier from MediaMarkt, a European consumer-electronics retailer.
- By his account the device held what looked like a hardware implant resembling an earlier version of the modification found in the CryptoBilis-linked units.
- The device had not sent funds to an exploiter, he said, and he offered two unverified explanations: the implant did not work, or an attacker is waiting.
- Binance co-founder Changpeng Zhao claimed that the attackers appear to have purchased the reseller outright and required its owners to sign a non-disclosure agreement.
- Separate social posts say CryptoBilis changed ownership earlier in 2026, but the evidence cited so far does not show the buyer was involved in the tampering.
Why it matters
- exposure Ledger's published steps cover CryptoBilis purchases from the previous 90 days, so a buyer from any other seller, Johannes included, falls outside them.
- contradiction Ledger confirms cases only through CryptoBilis, while Johannes says he knows of reports from Asia, South America and Europe. Confirmed and reported are different bars, so both statements can stand today.
- constraint A unit that has moved no funds cannot be sorted into either of Johannes's explanations from outside, so a lack of theft on one device is weak evidence that it is clean.
- decision Ledger says its direct channels are unaffected and advises against unauthorized resellers. A buyer choosing a seller is working from that statement.
Ledger calls the volume of affected devices limited [2], but it has yet to publish a precise count or confirm the total value lost [6]. Its earlier update confirmed an unauthorized hardware implant in one affected user's device and urged that user to re-seed [8].
The European unit is a different kind of evidence. If the resemblance Johannes describes holds, it points to an earlier iteration of the modification, but that rests on his description alone, and Ledger has not confirmed that the device is connected to the CryptoBilis investigation [4]. According to cryptotimes.io, a "purchase from a European retailer does not by itself establish a wider attack on Ledger's authorized distribution network" [5]. The report does not say whether MediaMarkt is an authorized Ledger reseller. Ledger's reply to the researcher was to direct readers to its latest update [10].
The ownership thread is thinner. A sale of the reseller, even if documented, would establish who ran the shop. It would not say how or when any device was altered, and the posts cited so far do not close that gap [15].
We think Ledger's account is the best-supported reading of the confirmed cases and is unproven for units nobody has examined. An inspection of the European device is what would move it, in either direction. Everything in the report concerns Ledger hardware, so a claim about other makers' wallets goes past the evidence.
What to watch
- Whether Ledger confirms or rejects a link between the European device and the CryptoBilis investigation, and says where that unit was sold.
- Whether Ledger publishes a count of affected devices and a total value lost.
- Whether any evidence emerges that CryptoBilis's new owner was involved in altering devices.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence30
- Adoption
- Insufficient
- Hype gap−10
- Incentives
- Insufficient
- Confidence35
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Ledger's October 11 update said all confirmed cases linked to the October 9 draining incident involved devices sold through the Southeast Asian reseller CryptoBilis.
- [2]
Ledger said the volume of impacted devices in the CryptoBilis incident was limited.
- [3]
Ledger reiterated that its own systems and direct sales channels remained unaffected.
- [4]
Ledger has not confirmed that the reported European device is connected to the CryptoBilis investigation.
- [5]
The reported purchase from a European retailer does not by itself establish a wider attack on Ledger's authorized distribution network.
- [6]
Ledger has not yet published a precise count of affected devices or confirmed the total value of cryptocurrency lost in the incident.
- [7]
Ledger's guidance remains specific to CryptoBilis purchases: customers who bought within the previous 90 days and have not initialized the device should not begin setup, and those who have configured one should consider moving assets to a new Ledger signer with a newly generated recovery phrase.
- [8]
Ledger had confirmed an unauthorized hardware implant in one affected user's device in an earlier update and urged users to re-seed.
- [9]
Ledger's update advised users against buying from unauthorized resellers and reminded authorized resellers and distributors to source products through authorized channels and not to restock returned products.
- [10]
Ledger responded to the researcher's discussion by directing readers to its latest update.
- [11]
Security researcher Johannes, posting as @0xJohannes_, said he purchased the device approximately two weeks earlier from MediaMarkt, a European consumer-electronics retailer.
- [12]
According to the researcher, the device contained what appeared to be a hardware implant resembling an earlier version of the modification reported in the CryptoBilis-linked devices.
- [13]
Johannes said he was aware of reports involving devices in Asia, South America, and Europe.
- [14]
Binance co-founder Changpeng "CZ" Zhao claimed the attackers had apparently bought the reseller and made its owners sign a non-disclosure agreement.
- [15]
Separate social media posts say CryptoBilis changed ownership earlier in 2026, but no evidence cited so far establishes that the buyer was involved in the device tampering.
- [16]
Johannes said the device had not transferred funds to an exploiter and suggested the implant might not have worked or an attacker might be waiting; these were hypotheses, not verified findings.
Sources
1 independent publisher whose own reporting we read for this story.
- cryptotimes.ioTampered Ledgers Reported in Europe as CZ Says Hackers Bought the Reseller
1 article · October 11, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Entities
- LedgerFollow
- CryptoBilisFollow
- Changpeng ZhaoFollow
- MediaMarktFollow
- SEAL 911Follow