Karpelès Lab CEO Mark Karpelès reports finding hardware spy implants inside Ledger Flex and Nano X devices sourced from authorized resellers Metapod in Singapore and MediaMarkt in Germany, expanding the scope beyond Southeast Asian reseller CryptoBilis. Ledger states its inspections of German stock showed no hardware tampering and confirmed asset drains remain limited to CryptoBilis units, noting built-in checks cannot detect added hardware.
Discovery of implants from Metapod and MediaMarkt
- ▪Mark Karpelès confirmed finding a spy implant inside a Ledger Flex purchased from Singapore airport reseller Metapod and a Nano X bought from German retailer MediaMarkt
- ▪Karpelès Lab CEO Mark Karpelès reported that spy implants were found in Ledger hardware wallets from two additional authorized resellers, Metapod and MediaMarkt, beyond Southeast Asian reseller CryptoBilis
Technical design of the hardware implants
- ▪The Ledger hardware wallet spy implant uses a three-chip architecture comprising one chip to read the screen, a cellular modem, and an eSIM to transmit extracted data
- ▪The Ledger hardware wallet spy implant design evolved from a wired-in circuit board to clip-in blank boards designed to fall directly into place inside Ledger Nano X devices
Retailer sales suspensions and inventory checks
- ▪Ledger stated that inspection of store and distributor stock in Germany revealed no signs of device tampering
- ▪MediaMarkt Saturn halted all Ledger hardware sales on October 13, 2026, in coordination with Ledger
Karpelès recommendations and future warnings
- ▪Mark Karpelès warned that previously costly and narrowly targeted hardware implants are likely to appear more frequently across hardware wallets in the future
- ▪Mark Karpelès recommended Ledger adopt tamper-evident packaging rather than shutting down its authorized reseller program entirely, calling it too drastic a response to the supply chain breach involving CryptoBilis-sourced devices
Story comments
Loading comments…