Backdoored Ledger wallets linked to $102M theft turn up in German retail stores

Hundreds of accounts drained

Ledger said on Friday that hardware implants hidden inside a number of its wallets, sold in Southeast Asia, allowed attackers to siphon roughly $102 million from their owners. According to blockchain analytics firm Bitquery, around 315 accounts tied to compromised devices sold by CryptoBilis — an authorized Ledger reseller based in Malaysia — were hit, with losses spanning Bitcoin, Ethereum, Tron and other tokens. Some of the stolen funds have reportedly been frozen at the addresses that received them, while other amounts sit in accounts flagged for fraud. Whether owners who bought devices from other sellers also lost money remains unclear, and it is not known how long the implants sat inside the devices before being used.

Compromised devices surface in Europe

The implants were first linked to an unknown number of Ledger Nano X units sold by CryptoBilis, and Ledger initially framed the problem as limited to that seller. But a user going by Johannes wrote on X that he found an implant, including an antenna, inside a Nano X he bought in person at a MediaMarkt store in Germany in August, after opening the device over the weekend once reports began circulating. He then purchased a second Nano X at another store in the same chain and found an implant in that one as well. He says no crypto has been stolen from him.

MediaMarkt is one of Europe's largest electronics retailers, with around 1,000 stores across ten countries, and is listed as an authorized Ledger reseller in Austria, Germany, Spain and Turkey. Johannes initially suspected he had bought returned units resold as new, but a store employee told him the devices were new and that returns are sent back to Ledger rather than restocked. Users and researchers have also reported finding implants in Ledger Flex and Stax models, the company's more recent devices, according to Zero Day.

A campaign that kept evolving

The implants are not new. Hardware hacker Joe Grand found them on several Nano X wallets and notified Ledger in March. He told Zero Day the company said it would investigate who was behind them, but he received no follow-up until he asked months later, when Ledger said it had found no evidence the implants had been used to steal funds. Grand published his findings and gave conference presentations in April and May.

Mark Karpelès, the former Mt. Gox chief executive, saw Grand's research, bought Ledger wallets himself, found more advanced versions of the implant, and published his findings last month. Because of his prominence in the crypto world, awareness spread quickly, and some observers believe the resulting attention pushed the thieves to act: last week a coordinated heist emptied compromised wallets, possibly before the attackers were ready and before owners could move their funds.

The tactics have also shifted. Grand's earlier discoveries all involved wallets from unauthorized online sellers that appeared to be short-lived operations. The implants found at CryptoBilis and MediaMarkt suggest the attackers are now deliberately compromising devices flowing through authorized resellers, exploiting the trust that vendors have long told customers to place in those channels and gaining wider distribution. Grand and other researchers say the newer implants are more sophisticated and harder to detect.

Ledger points at the reseller channel

Ledger, which is based in France, said on X that there is no indication its own security infrastructure, systems or services were compromised. Instead, the company suggested the problem may stem from authorized resellers obtaining wallets from illegitimate sources, or restocking returned products that had been tampered with, and said it is reminding resellers and distributors to source only through authorized channels and never restock returns. Ledger asked CryptoBilis to halt sales and shipments pending an investigation; CryptoBilis, which is authorized to sell in Malaysia, Indonesia and the Philippines, says it is cooperating. The company described the situation as an ongoing threat to the whole ecosystem and called on others in the industry to work together on strengthening physical supply chains. Ledger did not respond to an inquiry from Zero Day, while Johannes argues the pattern points to a compromise of Ledger's supply chain affecting inventory across MediaMarkt and Saturn stores in Europe.

Why it matters

Hardware wallets exist precisely because users are told not to trust intermediaries, and a supply-chain implant breaks that promise at the root: the device itself becomes the attacker. The campaign shows adversaries deliberately targeting authorized resellers — the exact channel vendors instruct customers to use — and iterating on their hardware to evade inspection. It also raises disclosure questions: an early warning from a well-known researcher sat unresolved for months until public reporting and a nine-figure theft forced action. For the broader industry, tamper-evident packaging, reseller auditing and faster incident response are now unavoidable topics, and anyone holding a hardware wallet should verify their device and watch vendor advisories closely.