Ledger: Bitcoin Family's three Singapore units opened clean, but a Flex from the same airport had an implant

Didi Taihuttu of The Bitcoin Family, who we covered on Wednesday when he said he had bought three Ledger wallets in Singapore, has now opened them on camera. By his account, all three came back clean: no extra wires, no cellular module, no antenna. The result is real evidence about three devices. It is not evidence about the batch, and it sits next to two developments that make the wider picture less comfortable.

What he says he found

In his video, Taihuttu says he paid $292 each, about $880 in total, at an airport store in Singapore after the Token2049 conference, and that the receipt predates the news of the CryptoBilis losses. The three units were sealed. He pried each one open, looked for the extra hardware described in earlier reports, found none, and says each still powered up afterward. The devices can no longer be returned or safely gifted, as he acknowledges. His purchase date and receipt are his own claims; we have not seen them independently.

One caution about the video itself: the segment showing an implant, with a voice describing a "version 1.2" board and a "Singapore airport unit," is footage of a different device, which he says he would show only for comparison. It is not something he found in his own.

The airport unit that was not clean

The Singapore airport link is not imaginary. ForkLog reported on October 13 that former Mt. Gox chief Mark Karpelès said a Ledger Flex bought at Singapore airport was "confirmed to contain a spy implant." The owner, Ben Yorke, had noticed marks on the device and never used it. ForkLog says Ledger did not comment on that case separately and pointed to its general investigation update. We could not find a second outlet confirming the airport detail, so treat it as one researcher's statement.

MediaMarktSaturn pulls the product

Our October 14 story said a Germany sales halt was unconfirmed. That has changed. Cointelegraph, The Defiant and ForkLog report that MediaMarktSaturn removed Ledger products from its stores and online platforms after a customer said two devices bought at separate stores contained extra cables and cellular modules. A retailer representative said it is in contact with the manufacturer. Outlets differ on the number of countries and stores affected, and we have not verified a count.

What Ledger has and has not said

According to Decrypt's account of Ledger's 72-hour update, every confirmed case of lost funds involves devices bought through CryptoBilis, and Ledger's own systems and direct channels are unaffected. Ledger has not confirmed an $86 million loss figure, and estimates from on-chain researchers vary widely. BleepingComputer reports that Ledger confirmed at least one affected device held a hardware implant. Ledger has not confirmed a link between the European devices and the Southeast Asian attack, and ForkLog says it is reviewing reports of implants elsewhere.

What it means for holders

Three clean units cannot clear a retail channel, and one retail pull cannot condemn it. What is consistent across the reporting is that the risk sits in where a device was bought and handled before the owner, not in the cryptography. Practical steps that follow from that: buy from the manufacturer, never use a pre-filled seed phrase, generate your own seed on the device, and if you bought through a reseller during the affected window and already set up the device, follow Ledger's guidance to move funds to a new seed. Self-custody is only one route; the point is to control where the key was created.

Bitcoin traded near $81,288 on Coinbase on Sunday morning, little changed against its open of $81,382. This has been a security story, not a price story. See also our October 12 report and crypto prices.

Sources: ForkLog; Cointelegraph; The Defiant; Decrypt; BleepingComputer; Coinbase Exchange API; The Bitcoin Family video (Taihuttu's own account). Information, not investment advice.