Ledger Implant Update Names One Seller; Users Quickly Push Back

An October 13 update from Ledger still ties its implant probe to a single vendor, Southeast Asian reseller CryptoBilis. Within minutes, users pushed back, saying tampered units had also turned up at MediaMarkt, a big European electronics retailer.

The company, for its part, maintains it is looking into reports of implants in other signers and places. The update itself, though, cited no retailer other than CryptoBilis, and that omission was read by critics as playing down the matter.

Does the Ledger Implant Issue Extend Beyond One Reseller?

Ledger Donjon, the company's in-house security team, has said the implant captures the recovery phrase from the screen during setup. Those 24 words are then sent out over a cellular connection.

Update from Ledger Donjon on the CryptoBilis investigation 🔽@DonjonLedger is investigating Ledger signers sold by CryptoBilis, a reseller in Southeast Asia, that contained an unauthorized hardware implant. Ledger confirmed this on October 10th for one affected user's signer.…

— Ledger (@Ledger) October 13, 2026

A number of users, however, argue the issue extends beyond Asia. The update's failure to mention MediaMarkt and other European locations drew repeated questions in replies.

One user claimed Europe's Ledger supply chain is also compromised. He said a second unit bought at another MediaMarkt store contained the same extra cables and cellular module, and he called for a recall, offering an unboxing video as proof.

... fresh device, directly from the store, video quality is kinda bad, sorry

— Johannes (4, 4) (@0xJohannes_) October 12, 2026

Store records, he added, tied the inventory to Aqipa, a European electronics distributor. He has since sent the device to Ledger so it can be analyzed.

To date, no case beyond CryptoBilis has been confirmed by Ledger.

Who Bears the Cost When Signers Are Tampered With?

Users who have been drained are told to contact Support so Ledger can add their cases, and to file a police report. The update did not mention reimbursement, though.

Ledger also has not confirmed how many users lost funds or the total amount. Through the reseller, one trader reportedly lost $6.6 million in Bitcoin after a purchase.

Meanwhile, Ledger's Genuine Check, a built-in authenticity feature, verifies the security chip but not every component around it. That means a hidden spy chip could still pass the check.

The company warns too that it will never phone users, send them direct messages, or ask for their recovery phrase.

CryptoBilis buyers are still advised by Ledger to shift funds to a fresh signer and generate a new recovery phrase. Some owners are now weighing their hardware wallets for signs of tampering, even though a matching reading is not very meaningful.

For now, the Ledger implant episode has moved the trust debate away from chips and toward shop shelves. Should a European case be confirmed, a reseller scandal could become a recall question.