The cryptocurrency security industry is facing an unprecedented threat. Supply chain attacks, previously considered targeted and localized, are now becoming widespread. Former Mt. Gox CEO and cybersecurity expert Mark Karpeles has confirmed the discovery of a high-tech spyware implant in a Ledger Nano X hardware wallet. Alarmingly, the device was not purchased from a questionable online vendor, but at MediaMarkt, a major German electronics retail chain.
This incident calls into question the very foundation of hardware wallet security, which has historically been considered the most reliable method for the “cold” storage of digital assets.
Timeline: From Suspicious Wires to the Unchained Broadcast
The alarm was first raised by an X (formerly Twitter) user under the pseudonym Johannes. On October 12, he shared disturbing news with the crypto community: foreign cables and a built-in LTE module were found inside two brand-new Ledger Nano X wallets purchased at different MediaMarkt retail stores in Germany.
Realizing the gravity of the situation, Johannes separated the discovered devices for independent analysis: one specimen was sent to the manufacturer (Ledger), and the second to independent researcher Mark Karpeles.
The package reached Karpeles on October 15. That same day, speaking live on the popular Unchained podcast, the expert confirmed the worst fears. He noted that although the layout of the malicious board differed slightly from samples previously found in Southeast Asia, the core premise remained the same: “It’s certainly the same implant.”
The Singapore Incident: Adapting to Premium Models
The German case was not an isolated incident. Earlier, on October 13, Karpeles published a report regarding the compromise of another, more advanced model — the Ledger Flex. This device was purchased by a user in the transit zone of Changi Airport (Singapore) from an official authorized reseller, Metapod.
The owner was saved solely by their own vigilance: before initializing the wallet, they noticed suspicious mechanical marks on the casing indicating tampering, and immediately sent the device for inspection.
The teardown revealed that the attackers had successfully adapted their malicious module to fit the Ledger Flex architecture. The embedded implant consisted of a complex system with three key components:
- Microcontroller (MCU) — implemented specifically to covertly read data directly from the device’s screen (including PIN codes and seed phrases).
- Cellular Modem — to provide an independent communication channel.
- eSIM Card — for the immediate and stealthy transmission of stolen confidential information to the hackers’ servers.
Industrialization of Hacking: The Shift to Mass Production
Perhaps the most frightening conclusion drawn by Mark Karpeles following his investigation concerns the manufacturing quality of the malicious modules. The hackers’ technologies are evolving rapidly.
While earlier samples of compromised devices featured components that were manually soldered using makeshift wires, the new versions utilize a solid, factory-quality printed circuit board. It is engineered so precisely that it fits into the Ledger casing with practically no need for additional modifications.
According to Karpeles’s assessment, the attackers spent several months and utilized substantial funding to develop such a custom solution. Previously, these implants were prohibitively expensive and used exclusively for targeted attacks on specific victims holding large balances. Now, it is evident that the technology has been optimized for mass production, and the expert urges the industry to brace for the discovery of new batches of infected devices worldwide.
Reaction from Ledger and Retailers: Emergency Measures and New Rules
The corporate sector reacted to the threat immediately:
- October 13: The MediaMarktSaturn network, in agreement with the manufacturer, completely suspended the sale of Ledger products both in physical stores and online.
- October 14-15: Ledger conducted a massive audit of its German distributors and stores, including the specific locations mentioned in Johannes’s investigation.
In its official statements, Ledger emphasized that no traces of tampering were found in new batches during the warehouse inspections. The company also reiterated that, up to this point, all confirmed cases of compromise (resulting in the theft of funds) were strictly tied to a single source: devices from the Asian reseller CryptoBilis. Karpeles, for his part, admitted that it cannot yet be stated with 100% certainty whether the MediaMarkt cases represent the beginning of a massive European epidemic or a highly sophisticated, isolated substitution at the retail stage.
Nevertheless, Ledger has introduced unprecedentedly strict rules for its authorized resellers:
- Sales Freeze: Distributors in Southeast Asia and Hong Kong were instructed to temporarily halt all device sales.
- No Open Displays: Wallets are banned from being displayed on the shop floor. Until paid for and physically handed over to the buyer, they must be stored exclusively in closed back rooms.
- Ban on Returned Goods: Reselling any wallets returned by customers is strictly prohibited. Even if the device was returned on the same day and the factory shrink wrap and holograms appear completely untouched, the device is now considered potentially compromised.
Financial Impact: Millions of Dollars in Losses (Including for the Hackers)
The scale of the operation is staggering. According to the blockchain analytics company Bitquery, the total damage inflicted on Ledger users as a result of attacks via infected wallets is already estimated at a colossal $93.2 million.
However, there is a touch of irony in this criminal enterprise. As reported by analysts from Chainalysis, one of the biggest victims in this entire chain turned out to be the scammer (or hacker group) themselves. Due to an unknown technical glitch or a counter-attack, the scheme’s organizer irrevocably lost access to 60 BTC, which translates to approximately $4.8 million in lost funds.
