Pre-Installed Spyware Discovered on Hardware Wallets in European Stores

A concerning supply chain security issue involving hardware wallets has emerged across Europe. Based on a detailed user investigation shared online, devices purchased from major electronics retail chains were found to contain unauthorized hardware modifications and pre-installed malicious software upon unboxing.

The Investigation: Two Purchases, Same Compromise

To confirm initial suspicions, the investigator purchased a second device from another branch of the same retail chain, documenting the entire unboxing process. The findings were alarming: the new device had been tampered with in an identical manner—extra cabling and an LTE communication module were added inside. The consistency of the modifications strongly suggests an organized supply chain breach rather than an isolated incident.

Scope of Impact: Potentially Europe-Wide

The scale of the vulnerability appears significant. Two major electronics retail brands, with over 1000 stores across 11 European countries, may have affected inventory. The common link points to distributor Aqipa GmbH, whose supply network spans Europe. This implies that any physical retailer sourcing from this distributor could be at risk.

Nature of the Threat: Tampering Before Retail Sale

Early theories suggested the devices might be repackaged returns. However, store staff clarified that returned units are sent directly back to the manufacturer and are not reshelved. This confirms that the compromise likely occurred post-manufacturing, somewhere in the logistics or storage chain before reaching retail stores—a classic supply chain attack vector.

User Actions and Critical Safety Advice

The user who discovered the issue has sent both tampered devices to the manufacturer for analysis, urging an official investigation into the source. He also issued urgent recommendations for all users:

  • Verify Your Purchase Source: Exercise extreme caution if your device was bought from an unauthorized retailer, particularly large electronics chains.
  • Conduct a Physical Inspection: Before activation, meticulously check the device for signs of tampering—look for broken seals, unexplained cables, solder points, or extra chip modules inside.
  • Demand Official Action: There are calls for the manufacturer to immediately assess the risk and initiate a recall for potentially affected batches to protect user assets.

This incident serves as a stark reminder for cryptocurrency holders: hardware security depends not only on product design but on every link in the supply chain, each a potential point of failure.