Ledger Faced Earlier Implant Warnings Months Before Its Security Crisis, Karpelès Says

Former Mt. Gox chief Mark Karpelès says French wallet maker Ledger was told about malicious hardware implants well before the current crisis became public. He knows of at least two people who contacted the company about tampered devices as far back as December 2025, and he has seen no public warning issued in response. Security researcher Joe Grand says he flagged an implant in a Nano X on March 4, 2026. The device had been bought through Lazada Thailand in August 2025.

Ledger acknowledged the report and said it was investigating, but Grand criticized it for not warning customers. Karpelès said a single case from a shady dealer may be easy to dismiss, yet the growing number of reports and the improving technology behind them should have prompted at least a reminder to be careful. Ledger declined to comment on how it handled the disclosure.

How the Crisis Surfaced

The current problem emerged on Oct. 9, when losses were reported involving wallets sold through CryptoBilis, an authorized reseller in Southeast Asia. Ledger has confirmed that one affected device carried an unauthorized implant.

Trezor Also Targeted by Unauthorized Sellers

In August 2026, Grand also alerted Trezor to tampered Trezor One and Model T wallets bought from unauthorized sellers on TikTok and Facebook. Trezor says such counterfeits appear occasionally and that its claim of no compromised devices covers only new wallets from authorized resellers. It added that a new technique, or a first case through an official channel, would be the point where it moves fastest, including warning customers directly.