# Ledger hardware wallet tampering with spy implants found in Europe

Source: https://x.com/0xJohannes_/status/2109240472933671125

## Summary

A user reports finding a hardware wallet with a spy implant in Europe, stating the Ledger device was bought in store from an official European reseller a couple of weeks earlier. The post says the device contained cables absent from a legitimate unit, shown in a second picture, and that the implant looked like an older version, while newer versions usually hide the implant by the screen. The poster notes the compromised device never transferred funds to an exploiter and asks whether it was waiting for wider use. The post advises owners of Ledgers not bought from the Ledger online store to open the device and check it physically, citing reported cases in Asia and South America, and points to videos by @MagicalTux on how to do so.

## Article

PSA the ledger incident isn't limited to Asia

This is a device purchased in store from an official reseller in Europe (a legitimate device doesn't have any of these cables as can be seen in picture 2)

This even seems to be an old version of the 'spy implant' even though the device was purchased a couple of weeks ago. The newer versions usually hide the implant by the screen so it's easier to miss

What's interesting is that this compromised ledger never transfered funds to an exploiter. Either the device didn't work or they were waiting for a more widespread usage of the comprised devices? 

If you own a ledger that didn't directly come from the ledger online store make sure to not just rely on the software genuinely check by ledger but to actually open up the ledger yourself to make sure its original, again there are reported cases in Asia, south America and now Europe as well.

@MagicalTux made some useful videos on how to open the ledger and what to look for.

## Comments

**mishaderidder.eth**: It doesn’t stop … oh yeah EU reseller is Mediamarkt 😅