A hardware wallet is meant to act as a vault for crypto holdings, keeping the private keys that control those funds isolated from internet-connected computers. According to Mark Karpelès, at least one Ledger device purchased in Malaysia arrived with a hidden stowaway built into it.

On October 9, 2026, the former Mt. Gox CEO published photos of a Ledger device that he said contained a concealed physical implant tucked into the padding behind the screen. The same day, Ledger announced it had opened an investigation into reported user losses connected to CryptoBilis, a reseller operating in Southeast Asia.

What Karpelès says he found

The alleged implant was far from a crude modification. Karpelès claimed the device contained LTE components, an antenna, an eSIM, and a microcontroller, all hidden within the buffer pad area behind the display. An eSIM is a SIM chip embedded directly in a device rather than a removable card, and LTE parts of that kind are what allow a device to hold a cellular connection on its own, independent of the owner's computer or home network.

The microcontroller was reportedly connected to the Ledger's SPI bus — the internal pathway that chips use to exchange messages, including data destined for the screen. According to the research findings, this configuration would allegedly allow the device to monitor display activity and transmit sensitive information, such as seed phrases, over cellular networks.

A seed phrase functions as the master key to crypto wallet. Anyone who obtains it can move the funds, and the original owner has no customer support channel to recover them.

Ledger halts CryptoBilis sales

Ledger's response centered on the sales channel. The company said it launched its investigation after reports of substantial losses among customers who bought devices from CryptoBilis, a Malaysia-based reseller.

Ledger instructed CryptoBilis to halt all sales and told customers who purchased through that channel not to initialize their devices.

The second instruction is the more critical one. Initialization is the moment a hardware wallet generates and displays a new seed phrase. If a device has been compromised, that is precisely when the secret would be exposed.

The full scale of the damage remains an estimate. Pseudonymous analyst Specter placed losses at more than $86 million across multiple wallets holding Bitcoin, Ethereum, and TRON. Those figures have not been independently confirmed.

The available reporting does not establish that the device Karpelès photographed was sold by CryptoBilis. The two disclosures emerged on the same day and point to the same region, but for now they remain separate threads.

Not the first case this year

Reports of hardware implants inside Ledger devices surfaced earlier in 2026, including notable cases in Thailand. Tampering carried out between a device's manufacture and its arrival with the buyer is known as a supply chain attack — a category of compromise in which the malicious hardware is in place before the owner ever opens the box. A pattern appears to be forming, one that runs through Southeast Asian resale channels.

Karpelès is a familiar name delivering an unusual warning. He previously led Mt. Gox, the Tokyo-based exchange that collapsed in 2014 after losing hundreds of thousands of bitcoin, the site of one of the most notable collapses in crypto's history.

What this means for hardware wallet buyers

Based on the available findings, the issue appears to sit with the reseller rather than with any flaw in Ledger's core product. That distinction is meaningful, though it may offer limited comfort to anyone who entrusted savings to a tampered device.

The attack described here bypasses the security that hardware wallets are designed to provide. A secure chip can perform its function perfectly and still be defeated if another component is reading the screen it communicates with.

Users are being urged to buy directly from Ledger's official channels and to follow the company's inspection guidance to verify device integrity. Anyone who purchased from CryptoBilis should refrain from setting up the device, in line with Ledger's instruction.

For Ledger, the key developments to watch are the outcome of its investigation and whether it confirms or revises the loss estimates. How the company handles affected CryptoBilis customers will also help determine how much user trust survives the episode.