Tampered Ledgers in the news: what you need to know

So far, we have no indication whatsoever that any tampered Ledgers have been sold through Cryptomaan or BTC Direct Shop. Since there is a lot of concern about reports of tampered Ledger devices, we explain below what is going on and how you can check your own device.

What is going on?

Ledger is investigating reports of tampered Nano X devices that were used to steal crypto funds. The first reports came from buyers at a specific reseller (CryptoBilis) in Southeast Asia. Malicious parties had built additional hardware (spyware) into these specific devices. This spyware can read the 24-word recovery phrase directly from the screen and transmit it via a built-in SIM card. Ledger has since confirmed that the device of one of the affected users contained an unauthorised hardware implant.

A report has also been made in Europe: a customer in Germany found an implant in a Nano X purchased from MediaMarkt. No funds were lost in that case. In consultation with Ledger, MediaMarkt Saturn has suspended the sale of Ledger devices in its stores and online since 13 October while the investigation is ongoing (post 1 and post 2). On 14 October, Ledger reported in a first update that no tampered devices whatsoever had been found at distributors and resellers in Germany (post 3).

Is your wallet affected?

At this moment, we have no indication whatsoever that any tampered Ledgers have been sold through Cryptomaan or BTC Direct Shop. We purchase our Ledgers exclusively through Ledger's official distribution channel. That reduces the risk, but nobody can give an absolute guarantee. Want to be sure? Below, we explain per model how you can check whether spyware has been added.

Why open the device? The spyware leaves Ledger's secure chip intact. As a result, Ledger's own authenticity check (Genuine Check) may not detect the tampering. A visual inspection of the inside is then the way to know for sure.

Opening the device is at your own risk. You may damage the device in the process. We do not necessarily advise you to do this, but we are happy to let you know what your options are.

How to check your device (step by step)

The videos below show how to open each Ledger model safely and what the original inside should look like:

Ledger Stax: Watch the instruction video for the Stax.
Ledger Flex: Watch the instruction video for the Flex.
Ledger Nano X: Watch the instruction video for the Nano X.
Ledger Nano S Plus: Watch the instruction video for the Nano S Plus.

Note on the Ledger Gen5: The frame of the Gen5 is made from a single piece. This device cannot be opened without causing significant damage.

You can also compare the components in your device with Ledger's official reference photos on the official Ledger Support page, under the tab for your specific model.

What to look for and what to do if something seems off

Look out for loose wiring: Loose cables or wires are the most important sign of physical tampering. Genuine Ledger devices have no internal cables.
Found something unusual? Do not set up the device if you have not done so yet. If you have already set it up, move your funds immediately to a new hardware wallet with a new recovery phrase. Consider your old recovery phrase compromised and do not restore it on a new device.
Contact us straight away if in doubt: Do you see anything unusual or are you unsure about the inside? Contact us immediately via WhatsApp on +31 6 19188975 or send an email to [email protected].

Beware of scammers: Ledger and BTC Direct Shop will never ask for your 24-word recovery phrase. Ledger will also never call you or message you unsolicited. Scammers specifically try to claim victims during incidents like this.

Even if you have carried out the check and everything looks perfectly fine, we would love to hear from you! That helps us get a clear picture of the situation among our customers.

Thank you for your time and cooperation. We are monitoring the situation closely and will keep you informed of any new developments.

Follow official updates from Ledger itself via @Ledger and @Ledger_Support on X.

Last updated: 14 October 2026