Former Mt. Gox CEO Says Ledger Received Early Reports of Hardware Wallet Implants
Key Takeaways
- •Former Mt. Gox CEO Mark Karpelès said at least two people, including crypto educator Tai Zen, contacted Ledger about suspected tampered devices as early as December 5, with no public warning from the company.
- •Security researcher Joe Grand notified Ledger on March 4, 2026, about a malicious implant in a Nano X purchased from a third-party seller on Lazada Thailand, and said Ledger investigated internally without proactively warning customers.
- •Ledger's security crisis became public on Oct. 9, when losses tied to a wallet sold through authorized Southeast Asian reseller CryptoBilis were reported, and Ledger confirmed one affected device contained an unauthorized implant.
- •The tampered Ledger was bought from a Lazada seller identified as "LedgerXXX," which does not appear on Ledger's authorized reseller directory for Thailand, though Lazada's Ledger storefront is listed.
- •Trezor received reports in August 2026 of tampered Trezor One and Model T wallets bought from unauthorized sellers on TikTok and Facebook, and it treats such reports as early warnings, while OneKey removed its reseller listings pending stricter checks.
French hardware wallet manufacturer Ledger received multiple reports of malicious hardware implants months before its latest security crisis, according to Mark Karpelès, former CEO of the collapsed Bitcoin exchange Mt. Gox.
Karpelès told Cointelegraph that he is aware of at least two people who contacted Ledger about tampered devices dating back to December 2025. He said he has not encountered any public warning issued by the company in response.
Security researcher Joe Grand told Cointelegraph that he alerted Ledger on March 4, 2026, to a malicious implant in a Nano X he had purchased through the online marketplace Lazada Thailand in August 2025. According to Grand, Ledger acknowledged his findings and said it was investigating internally, but he criticized the company for failing to proactively warn customers about the threat.
Vietnamese crypto educator Tai Zen also contacted Ledger about a suspected hardware wallet implant in December 2025, according to Karpelès.
Ledger's ongoing security crisis surfaced on Oct. 9 — roughly seven months after Grand's alert — when crypto losses were reported involving wallets sold through CryptoBilis, a reseller authorized in Southeast Asia. Ledger has confirmed that one affected device contained an unauthorized implant. Unlike the implant Grand reported, which was in a device bought from a third-party marketplace seller, the October losses involved a wallet sold through an authorized regional reseller.
Asked about its handling of Grand's disclosure, Ledger declined to comment and referred Cointelegraph to its public statements on X. The outcome of the internal investigation Grand described, and whether Ledger will proactively warn customers about tampered devices, remain open questions as the episode continues.
“Maybe Ledger not responding to a single event of an implant found on a Ledger purchased from a shady dealer is normal,” Karpelès said. He added: “However the increasing number of reports they must have received, and the increasing quality/technology used have alerted them enough to act, and at least remind customers to be careful.”
Marketplace listings expose reseller verification gaps
In a presentation shared with Cointelegraph, Grand identified the seller of the tampered Ledger as “LedgerXXX” on Lazada. At the time of writing, LedgerXXX is not listed as an authorized reseller in Thailand on Ledger's reseller directory, though Lazada's Ledger storefront is.
Cointelegraph sought clarification from both Grand and Ledger regarding the seller's identity and authorization status at the time the device was purchased.
Archie, head of sales at hardware wallet maker OneKey, told Cointelegraph that marketplaces such as Lazada host numerous independent sellers, making it difficult for customers to distinguish authorized stores from other listings. Following the recent incidents, OneKey removed its reseller listings pending stricter checks, saying manufacturers must take responsibility for protecting customers rather than relying solely on buyers to identify trustworthy sellers.
Unauthorized wallet sales still raise security concerns
Grand's findings were not limited to Ledger. In August 2026, he also alerted Trezor about tampered Trezor One and Model T wallets purchased from unauthorized sellers on TikTok and Facebook.
Trezor told Cointelegraph that counterfeit wallets occasionally appear through unauthorized sellers, as it had warned in 2022 about modified devices sold on Russian marketplaces. The company said its recent claim of no evidence of compromised devices applied only to new wallets sold through authorized resellers.
Related: Trezor reduces resellers as a 'preventative step' amid Ledger tampering reports
Trezor said it nonetheless treats reports involving unauthorized sellers as early warnings and uses researchers' findings to improve its security checks.
“What changes the picture is a new technique, or a first case coming through an authorised channel,” Trezor said. “Either one means the problem has moved closer to ordinary buyers, and that's when we'd move fastest, including warning customers directly.”
Magazine: Scammer Loses $4.8M Stored On Tampered Ledgers: Asia Express
