Published List of Stores with Infected Ledger Wallets

On-chain analyst Darkfost published a list of 24 Ledger stores in Asia and Europe where tampered wallets may be sold. Ledger confirmed the issue only with the Malaysian reseller CryptoBilis. Another case in the German MediaMarkt was reported by a user on X. The other stores were included in the list simply because they might receive products through the same channels. The analyst criticized Ledger: users on X are sharing more about the risks than the manufacturer itself.

Darkfost included only sellers from Ledger's official website in the table. Accusations have been publicly made only against CryptoBilis, and being listed does not imply the store's guilt.

In the Asian section, there are 19 sellers from six countries: Indonesia (CryptoBilis, Shopee Mall, Tokopedia, N-Crypt), Malaysia (CryptoBilis, Shopee Mall), Philippines (CryptoBilis, Shopee Mall, Lazada, CryptoKing PH), Singapore (Shopee Mall, Lazada, Challenger, Metapod, iShopChangi, Pantrade), Thailand (Shopee Mall, Lazada, Dot Life, JIB, B2S, SiamBC, Butkus, Groov asia, RTB), Vietnam (Shopee Mall, Lazada, BitcoinVN, Digibit).

The European block is linked to one distributor – Aqipa GmbH. According to the analyst, it has been officially supplying Ledger since August 2023, mainly to Germany and Austria. The table lists five networks that could receive products through Aqipa: MediaMarkt in Germany and Austria (a user claimed to have found a tampered wallet there, the batch came from Aqipa), Saturn in Germany (part of the same group as MediaMarkt, direct link to Aqipa not documented), Fnac/Darty and Boulanger in France (Aqipa claims partnership), MediaMarkt Suisse in Switzerland (connection through partner Thali).

According to Darkfost, random users on X provide more information about risks, verification methods, and affected devices than the manufacturer. He also noted that Ledger asked for the wallet from MediaMarkt to be sent for analysis but did not offer to cover shipping costs.

Ledger stated that it is investigating reports of backdoors in other devices and regions but has not confirmed any cases outside of CryptoBilis. The company advises purchasing wallets only from them or official resellers and reminds that it never requests the 24-word recovery phrase.