The company confirmed physical tampering in at least one affected device. In addition, reports emerged that the incident has spread to Europe.

After reports emerged of a potential theft of over $80 million in crypto from its devices, Ledger confirmed over the weekend that at least one wallet tied to the ongoing CryptoBilis investigation contained an unauthorized hardware implant.

Meanwhile, a new community report on X claimed a suspicious Ledger device bought from MediaMarkt in Europe may also have been compromised, which would widen the scope well beyond Southeast Asia.

Ledger Confirms

In the latest update published on Saturday evening, the hardware wallet manufacturer said it had examined one device belonging to an impacted user and found an “unauthorized hardware implant” inside. The team said they have contacted affected users and have started working with authorities.

CryptoBilis has also responded to Ledger’s plea to stop sales of all hardware-wallet inventory, not merely Ledger products, until the investigation is concluded. The company behind devices such as Nano X said it has no indication that its own security infrastructure, systems, or services were compromised. It has also yet to determine how many affected devices contain implants or confirm that the discovered implant is responsible for all reported wallet drains.

The initial report, which we published yesterday, stated that customers who bought through CryptoBilis in Indonesia, Malaysia, and the Philippines were impacted. Initial investigations claimed the suspected losses exceed $86 million, but a new report from Bitquery puts that estimate closer to $93 million across 311 wallets on five chains.

Europe, Too?

A post from one X user claimed that a Ledger purchased through MediaMarkt in Europe also showed signs of possible hardware manipulation. The report quickly circulated through the vast crypto community, prompting warnings that the incident may no longer be geographically isolated to Southeast Asia.

However, the European situation has not been confirmed as compromised by the wallet manufacturer, and users examining the published images disagree about what they actually show. Some argued that the hardware appears inconsistent with a genuine Ledger board, while others said they could not see the same type of additional implant identified in the Southeast Asian case.

You may also like:

Nevertheless, MediaMarkt is an official reseller for Ledger in several European markets, including Germany and Austria. For now, though, this unconfirmed part of the story remains uncertain, while the original case in Asia continues to take new victims, according to reports on X.