Mark Karpelès found a spy implant in a Ledger Nano X wallet from Germany, raising security concerns for hardware wallets.
Mark Karpelès, the former CEO of Mt. Gox, has reported finding a spy implant in a Ledger Nano X wallet purchased from MediaMarkt in Germany. This discovery raises significant security concerns for hardware wallets.
Ledger Nano X received from @0xJohannes_ (who bought it from MediaMarkt in Germany) confirmed bugged (he sent another one to @Ledger). This is not news and action has already been taken, the next question will be to understand how this ended in Germany… https://twitter.com/MagicalTux/status/2110697933796696536
— Mark Karpelès (@MagicalTux) October 15, 2026
The wallet was sent to Karpelès by a user named Johannes, who had reported suspicious cables and an LTE module in two Nano X devices from different MediaMarkt locations. Johannes forwarded one device to Karpelès and the other to Ledger for investigation.
Karpelès received the device on October 15 and discussed his findings during a broadcast. He noted that the implant's design was different from those seen in Southeast Asia, but he believes it is likely the same type of implant.
Additionally, Karpelès mentioned another case involving a Ledger Flex wallet purchased from a reseller in Singapore, which also exhibited signs of tampering.
Karpelès: Implant Designed for Mass Production
Karpelès indicated that the malicious modules have become more sophisticated, transitioning from wired connections in earlier versions to a printed circuit board that fits seamlessly into the device. He suspects that the developers invested considerable time and funding into this implant, which is now designed for mass production, predicting more cases may emerge.
Ledger Denies Compromise of German Devices
In response to the findings, MediaMarktSaturn has temporarily halted sales of Ledger products both in-store and online, a decision made in consultation with Ledger. However, Ledger stated that they have inspected devices from various stores and warehouses in Germany and found no signs of tampering, although they have yet to examine the wallets that were publicly reported.
On October 15, Ledger reiterated that all checked samples were clear of implants. The company previously noted that confirmed thefts were linked to devices from the Southeast Asian reseller CryptoBilis.
Karpelès acknowledged that he could not definitively conclude if Johannes' wallets were isolated incidents. Ledger has also asked its authorized resellers to suspend sales in Southeast Asia and Hong Kong and has tightened regulations for partners, including prohibiting the display of devices in open showcases.
In related news, Bitquery has estimated the financial damage from the attack on Ledger users to be around $93.2 million, with Chainalysis reporting that even the scammer believed to be behind the attack lost approximately 60 BTC, valued at around $4.8 million.
