Former Mt. Gox CEO Mark Karpeles identified a malicious implant in a Ledger Nano X hardware wallet. The device was originally purchased at a MediaMarkt store in Germany by a user known as Johannes.
The implant consists of three components: a microcontroller for screen data extraction, a cellular modem, and an eSIM for data transmission. Karpeles noted that the hardware design has evolved from manual wiring to custom-fitted printed circuit boards, suggesting mass production capabilities.
A similar incident was reported regarding a Ledger Flex model purchased at an authorized reseller, Metapod, in Singapore's Changi Airport. The owner discovered suspicious markings on the device casing before use.
Following these reports, MediaMarktSaturn suspended Ledger product sales on October 13. Ledger stated that internal inspections of stock in Germany revealed no signs of tampering, though the company has not yet examined the specific units shared online.
Ledger has implemented stricter security protocols for partners, requiring devices to be stored in backrooms rather than displayed on open shelves. The company also prohibited the resale of returned units and requested a temporary sales halt in Southeast Asia and Hong Kong.
