Ledger is facing questions about how it handled reports of tampered hardware wallets, after former Mt. Gox CEO Mark Karpelès said the French company alerted to compromised devices months before its current security crisis became public. According to crypto analytics firm Santiment, about $90 million has reportedly been stolen from tampered Ledger wallets sold through CryptoBilis, a reseller authorized in Southeast Asia, though Ledger has not verified the total. Hidden LTE implants inside the devices copied users' 24-word recovery phrases during setup and transmitted them over an eSIM.

Former Mt. Gox CEO: Ledger Received Hardware Wallet Tampering Reports Since December 2025 but Issued No Public Warning

Former Mt. Gox CEO Mark Karpelès said Ledger had received reports of hardware wallets tampered with and fitted with malicious components since at least December… pic.twitter.com/Vmv4zXChEk

— Wu Blockchain (@WuBlockchain) October 16, 2026

Karpelès told Cointelegraph that he knew of at least two people who contacted Ledger about tampered devices starting in December 2025, and that he has not seen any public warning from the company in response.

Security researcher Joe Grand says he told Ledger on March 4, 2026, about a malicious implant in a Nano X that he had bought through Lazada Thailand in August 2025. Ledger said it was investigating, but Grand criticized the company for not warning customers. Ledger declined to comment on how it handled Grand's report and pointed Cointelegraph to its public statements on X.

How the Implant Stole Recovery Phrases

The crisis became public on October 9, when crypto losses were reported involving wallets sold through CryptoBilis. On October 13, Ledger's Donjon security team confirmed the devices contained hidden LTE implants.

A recovery phrase is a list of 24 words that can restore a wallet on any device. According to Ledger, the implant sits in a separate part inside the case and reads the words from the screen during setup. It then sends the phrase over a 4G network using a built-in eSIM. The company says the attack does not touch its Secure Element chip and does not change any transactions. Thieves can instead restore the wallet on their own device and move the funds — which means the phrase alone is enough to take over a wallet, with no access to the original device required.

Security firm Tibane Labs found three versions of the implant. It bought the third version from a Japanese online marketplace, and it shipped from Malaysia. Taken together, the known implanted devices surfaced through several different channels — Lazada Thailand, a Japanese marketplace and CryptoBilis' retail stock — leaving open where in the supply chain the tampering occurred.

Losses and Reseller Fallout

Santiment estimates that about $90 million has been stolen, while blockchain investigator Specter puts the loss above $86 million across Bitcoin, Ethereum and Tron. Ledger says the figures come from third parties and that it has not fully verified them.

The company says every confirmed case links to CryptoBilis. The reseller has paused hardware wallet sales until the investigation ends, and Ledger has also asked resellers across Southeast Asia and Hong Kong to stop selling.

Trezor said it found no tampered devices from CryptoBilis but ended ties with the reseller anyway. OneKey revoked CryptoBilis' authorization, will replace devices bought between March 1 and October 13 for free, and has removed the reseller's listings pending stricter checks.

Grand also alerted Trezor in August 2026 about tampered Trezor One and Model T wallets from unauthorized sellers on TikTok and Facebook. Trezor said it treats such reports as early warnings.

Some claims remain unverified. Karpelès said a Ledger Flex bought at Singapore's airport may have an implant. In Germany, MediaMarkt Saturn paused Ledger sales after a customer report, but no funds were lost.

What Ledger Owners Are Told to Do

Ledger's Genuine Check cannot detect physical changes if the Secure Element is intact, meaning a passing result does not rule out an implant. Ledger says users who set up a CryptoBilis device in the last 90 days should move their funds to a new device with a new recovery phrase.

The company's inspection of European retail stock found no signs of tampering. Ledger has not said how many users are affected or how the devices entered CryptoBilis' stock. Those open questions, along with the outcome of the investigation that prompted CryptoBilis' sales pause, are the developments to watch as the situation unfolds.

In the week ending October 16, Bitcoin fell 0.4% and Ethereum fell 1.8%.

This article is based on reporting by CoinCentral.