Ledger CEO Pascal Gauthier and Mark Karpelès, the former chief executive of the collapsed Mt. Gox exchange, traded public criticism on X on October 17. The dispute centers on how clearly the hardware wallet maker warned customers about tampered devices linked to an estimated $90 million in crypto thefts, and it unfolded as fallout continues from compromised Ledger units distributed through a third-party reseller in Southeast Asia.

Karpelès questioned whether Ledger had adequately warned buyers about spying implants found in modified wallets. Gauthier defended the company's security record and pressed critics to separate proven facts from guesswork. Hardware wallets are designed to keep a user's private keys offline, which makes the integrity of the supply chain critical. The episode illustrates the specific risk of tampering at the resale stage: a buyer receives a genuine device, but one that has been altered after leaving the factory.

Correction: I said @Ledger didn't talk about the implant situation at all despite knowing about it – they did publish an academy topic in March 2026 that talks about it and recommends buying direct or from Authorized Resellers. pic.twitter.com/UNrxyLnsmd

— Mark Karpelès (@MagicalTux) October 17, 2026

Karpelès argued that a stronger warning could have saved users more than $90 million in losses. He also said Ledger received reports of spy hardware implants as early as December 2025.

Gauthier answered with a personal jab referencing Karpelès' history. "Coming from Mt Gox CEO… Come on man. You are no white knight. Get real," he wrote.

Mt. Gox, once the world's largest Bitcoin exchange, collapsed in 2014 after major Bitcoin losses. Karpelès said that experience is precisely why he expects stronger security communication from companies that hold customer assets.

What Ledger Published and When

Karpelès pointed to a Ledger security guide titled "Best Practices To Securely Buy Your Ledger Signer." Ledger's website lists March 6, 2026 as the guide's first publication date. The guide recommends buying devices directly from Ledger or through authorized resellers.

The guide covers counterfeit devices, wallets shipped with preset recovery phrases, and genuine devices altered after leaving the factory. It includes photographs of modified circuit boards. The page was last updated on September 18. Without a saved copy of the March version, it is unclear when each photo or warning was added.

Ledger has not said when it first learned of the affected CryptoBilis devices. That undisclosed timeline is central to the dispute. The public exchange between the two executives does not show that the company deliberately concealed information.

How the Attack Worked

Investigators discovered extra electronics hidden inside a genuine Ledger device sold through CryptoBilis, a reseller in Southeast Asia. The implanted hardware could capture a 24-word recovery phrase while the wallet was being set up, then transmit the words over a cellular connection. A recovery phrase functions as the master backup for a hardware wallet, so anyone holding the complete phrase can access the linked funds without ever touching the device.

Ledger says its Genuine Check, a verification feature buyers can run before using a device, only confirms that the Secure Element chip is authentic. It cannot spot added components if the original chip remains in place. The company said the Secure Element, the operating system, and the signing process were not compromised. On October 9, it asked CryptoBilis to halt sales and shipments.

Galaxy Research estimated roughly $91 million in suspected losses on October 16. Ledger has not confirmed a final total, and a separate report placed losses above $100 million.

Ledger advised customers who bought from the reseller within the past 90 days not to set up unused wallets. Those who had already done so were told to move their funds to a new wallet on a trusted device.

Karpelès says similar implants have surfaced in other regions and that he has helped users inspect their devices. Ledger disputed reports of European exposure after reviewing a case in Germany. Trezor and OneKey have removed third-partyellers and tightened their distribution checks. The moves target the same weakness the attack exposed: once a device's original chip is verified as authentic, standard checks cannot detect hardware added around it, which puts the weight of assurance on the sales channel itself. Ledger maintains the compromise is limited to Southeast Asia, while others say it reached further. A confirmed loss total and the full geographic reach of the tampering remain unestablished.