Second tampered Ledger device found at separate MediaMarkt store
Regulation & Gov ·
A buyer who purchased a Ledger hardware wallet from a different MediaMarkt location says the device contained the same spyware modifications found in an earlier case, prompting a call for Ledger to recall affected products.
According to a post detailing the discovery, the buyer recorded the unboxing of a second Ledger device purchased at a different MediaMarkt location and again found spyware installed on it, with the compromise matching the first device "in the exact same manner," including identical additions such as extra cables and an LTE module, as described in the thread on X. The repetition across two separate stores is cited as evidence that the issue is not isolated but potentially widespread across Ledger inventory sold through MediaMarkt and Saturn stores in Europe, a retail network described as comprising over 1,000 stores across 11 countries.
The buyer initially suspected the units were returned devices resold as new, but a MediaMarkt employee reportedly confirmed the purchased device was not a return, stating that returned Ledger units are sent directly back to the manufacturer rather than restocked for sale. This account rules out the simplest explanation for how a compromised device ended up on store shelves, leaving the point of tampering earlier in the supply chain.
Store records reportedly trace the inventory to Aqipa GmbH. The post notes that Ledger's CTO was not certain whether Aqipa serves as the direct distributor linking Ledger to MediaMarkt, but the buyer states it appears to be the case. Because Aqipa is described as distributing across Europe, any retail store receiving stock through that channel could be exposed to the same risk, according to the post.
The buyer says the first compromised device was sent to a security researcher known as "mark," while the second unit is being sent to Ledger for analysis. Purchasers are advised to check any Ledger device bought from a source other than the official Ledger store.
What remains unconfirmed is the exact point in the supply chain where the tampering occurred, the full scope of affected inventory across MediaMarkt and Saturn locations, and whether Ledger or Aqipa will issue an official statement or recall. The cluster currently reflects two corroborating accounts of the discovery, and results from Ledger's analysis of the submitted devices are still pending.