Two factory-sealed Ledger Nano X devices purchased from German retailer MediaMarkt were found to contain suspected hardware spyware that captures 24-word recovery seeds from the device screen and transmits them over cellular networks, researchers reported. Forensic inspection traced the affected units’ distribution through European electronics distributor Aqipa GmbH, and on-chain analysis links the technique to prior attacks that drained more than three hundred wallets and stole tens of millions of dollars in digital assets.
What was discovered
A customer identified as Johannes bought two separate Ledger Nano X units from two different MediaMarkt stores in Germany. Independent teardowns and veteran cybersecurity researchers found identical, factory-grade physical modifications inside both devices. The implants were installed in a way that defeated visual retail inspections and allowed the units to appear factory-sealed while carrying covert hardware additions.
How the implant works
The malicious modification consists of a custom, panelized flexible printed circuit board (flex-PCB) placed between the device mainboard and the OLED display connector. The flex-PCB intercepts display bus signals and records every pixel rendered on the screen. A miniature micro-controller decodes the pixel data into the displayed 24-word recovery seed and a concealed low-power cellular transmitter, powered via a direct hook to the internal battery, exfiltrates the captured seed remotely. Because the implant reads the screen data downstream of the Secure Element, it operates independently of the device firmware and host connections.
Why genuine attestation failed
Software-based authenticity checks performed by official companion applications perform a cryptographic handshake with the Secure Element. In the tampered MediaMarkt units the Secure Element and firmware were genuine, so the companion software returned a “Genuine” verdict. Because the implant passively sniffed the display data after it left the Secure Element, cryptographic attestation could not detect the physical modification.
Wider campaign and supply-chain implications
Investigators link the technical footprint of these European tamperings to earlier unauthorized modifications in Southeast Asia. The manufacturing quality of the panelized flex-PCBs, specialized display bridge connectors and miniaturized cellular components indicate an industrial-scale operation rather than amateur activity. On-chain forensic work associates the deployment signatures with attacks that emptied more than three hundred individual wallets, resulting in tens of millions of dollars in illicit transfers. The devices examined were traced through Aqipa GmbH, indicating tampering during warehousing, shipping or restocking rather than at the manufacturer’s secure fulfillment facilities.
Custody risks and recommended mitigations
The incident highlights the structural weakness of single-signature custody when hardware is compromised at the distribution level. If an attacker captures a device’s mnemonic seed at setup, they can clone and drain wallets remotely. Firmware updates do not remove hardware-level implants because these are physical components outside the processor and Secure Element.
Practical mitigation steps advised for users who bought devices through third-party retail distributors include:
– Treat the mnemonic seed as compromised and perform an emergency migration of assets to new, verified addresses generated on a secure environment.
– Audit acquisition provenance and review invoices to confirm devices shipped directly from manufacturers rather than via third-party logistics.
– Transition to multi-signature custody models and multi-vendor quorums so a single compromised device cannot move funds alone.
– Prefer direct-from-manufacturer procurement and avoid third-party retail shelves, warehouses and open marketplaces when acquiring signers.
– Avoid opening suspect devices at home to preserve forensic evidence; destructive or amateur teardowns can damage batteries and connectors and obscure diagnostics.
Design and institutional responses
Interest in stateless and optical air-gapped hardware designs has increased because such architectures remove persistent wireless components and reduce internal volume available for covert implants. Optical air-gapped devices communicate via QR codes or visual markers and stateless designs avoid storing seeds permanently on board, making unauthorized internal modifications easier to spot.
For institutional buyers, the MediaMarkt discoveries underscore the need for stricter procurement and custody controls: use direct factory orders, tamper-evident transit containers with forensic identifiers, selective destructive or laboratory batch sampling on deliveries, and formal hardware whitelisting procedures to reduce exposure to logistics-level tampering.
The presence of sophisticated display-sniffing implants in mainstream European retail channels demonstrates that mass-market electronics distribution does not provide bank-grade assurance for cryptographic hardware. In response, cryptocurrency holders and institutional custodians should reassess procurement, harden custody architectures, and move toward vendor-diversified, decentralized signing models to mitigate supply-chain threats.
