Mark Karpelès, the former CEO of the Mt. Gox exchange, has publicly criticized hardware wallet maker Ledger, saying the company did not respond well to early warnings that spy hardware had been hidden inside devices sold through one of its resellers. Karpelès led Mt. Gox, once the world's largest Bitcoin exchange, until its collapse in 2014.

The criticism centers on a supply chain attack linked to CryptoBillis, a Ledger reseller, through which users who bought devices lost more than $90 million. Karpelès argues that Ledger received reports of the implants months before it publicly addressed the problem. The stakes are built into the product itself: hardware wallets are designed to keep a user's seed phrase — the recovery phrase that grants full control over a wallet's — offline and out of reach of internet-connected devices, and a supply chain attack, which targets products in the window between manufacture and delivery, strikes at exactly that protection.

Early Warnings Said to Date to December 2025

According to Karpelès, Ledger received reports of hardware implants as early as December 2025. He said the company's only public response was a blog post about a compromise published in March 2026, and he believes clearer communication at the time could have prevented the losses that followed. He noted that Ledger's March article itself showed both a hand-made implant with an improvised LTE antenna, observed by the hardware hacker Joe Grand, and high-budget, mass-produced devices.

"I do know a better communication on this at the time could have saved 90+ million USD in losses," Karpelès wrote on X.

In a post on October 17, 2026, Karpelès rejected suggestions that his own record at Mt. Gox should discredit his warnings:

I'm not sure MtGox has anything to do with that. You received multiple reports of implants in early 2026, and by March you published an article that showed both the hand-made style of implants Joe Grand saw (with the improvised LTE antenna) and the high budget mass produced…

— Mark Karpelès (@MagicalTux) October 17, 2026

Source post on X

He added that he could not understand how the company failed to be alarmed by "mass-produced advanced implants." Karpelès also admitted his own failures at Mt. Gox, saying he held Ledger to a higher standard because he "trusted you to do better by learning of my failure."

Ledger Pushes Back on the Claims

Ledger CEO Pascal Gauthier rejected the criticism, describing Karpelès' comments as virtue signalling and pointing to his past at Mt. Gox. The exchange between the two became personal, moving away from the central question of whether the attack and the stolen funds could have been avoided.

Karpelès also accused Ledger of downplaying the incident, saying the company treated it as limited to CryptoBillis even though similar implants were reported in other regions. Ledger has disputed reports that devices in Europe were affected, a conclusion the company reached after analyzing a reported case in Germany. Karpelès disagreed, saying the attack reached further, and said he had helped several users check their devices for signs of tampering.

"An end user doesn't know that, and shouldn't have to worry if their device is altered or not," he wrote, calling on Ledger to share clearer information.

Many members of the crypto community sided with Karpelès, pressing the company to be more open about the attack and its scope.

Confirmed Implants and an Industry-Wide Response

In early October, Ledger confirmed that devices sold by CryptoBillis contained unauthorized implants. The implants scanned users' seed phrases and sent them to a private server. Because a seed phrase on its own can restore a wallet on any compatible device, capturing one directly exposes the funds it protects. Ledger paused sales through CryptoBillis and the wider Southeast Asian region, and losses from the attack later passed $100 million.

Other wallet makers, including Trezor and OneKey, responded by removing third-party resellers and tightening checks on how their devices are distributed, targeting the same reseller channel through which the implants were introduced.

As of October 18, Ledger maintains that the compromise is limited to Southeast Asia. Karpelès and others continue to claim the attack has spread to other regions, and the dispute over the incident's true scope remains unresolved. The episode has left buyers with an open question the industry has yet to answer: how to confirm that a device has not been altered in the chain between its manufacturer and their hands.

Source: Blockonomi