UPDATE: I can confirm that the Ledger supply chain is compromised in Europe as well. @Ledger should initiate an immediate product recall to protect users. I just purchased a second device from a different Mediamarkt location today, recorded the unboxing process, and discovered spyware once again (video linked in the second tweet). The device was compromised in the exact same manner, featuring identical modifications (such as additional cables and an LTE module). This indicates its a widespread issue rather than an isolated incident, potentially affecting Ledger inventory across MediaMarkt and Saturn stores throughout Europe (comprising over 1,000 stores across 11 countries). My initial hypothesis was that these devices were returns that looked unopened to the employees and were just sold again as new however, a MediaMarkt employee confirmed that the device I purchased was not a return, and that returned Ledgers are sent directly back to the manufacturer rather than resold. Store records show the inventory originated from Aqipa GmbH. While Ledger's CTO was unsure if Aqipa serves as the direct distributor between Ledger and MediaMarkt, it appears to be the case. Given that Aqipa distributes across Europe, any physical retail store receiving stock through them may be at risk. I sent the first ledger to mark and the second one is going to ledger now, so that they can analyse it. If you purchased a ledger from anyone other than the official ledger store, make sure to check your device!!

🚨LEDGER SPY IMPLANT FOUND IN EUROPE TOO! @0xJohannes_ says a Ledger he bought in store from an official European reseller had extra cables inside. A clean device does not. He says it looks like an older version of the spy implant. @MagicalTux said the antenna is labeled as a Eurasian version, so more could be out there. Reports now include Asia, South America, and Europe. Always buy from the maker.