1. What Karpelès says he found
Mark Karpelès, chief executive of Tokyo-based Karpelès Lab, said this week that the Ledger implant first found in wallets from Southeast Asian reseller CryptoBilis has also turned up in devices from two more authorized resellers. He added that the newest version of the implant is built for mass production. Ledger, for its part, says German store stock it examined showed no signs of tampering.
The claims came during a livestream on October 15 and in posts on X. They add two new devices to a Ledger tampering episode that has already involved a wave of wallet drains reported on October 9. Because the new reports involve authorized resellers in Singapore and Germany, they raise the question of whether the problem is confined to one seller or reaches further into the retail chain.
Neither claim has been confirmed by Ledger, which said it has not yet been able to examine the specific devices shown online. Readers should treat the findings as Karpelès's account, set against the company's own statements.
Ledger is one of the best-known makers of hardware wallets, devices that keep the private keys for cryptocurrency offline. The Nano X and the Flex are two of its current products, and both show a recovery phrase on their screens during setup. That design is meant to keep secrets away from internet-connected computers, so a tampered device that quietly reads the screen undermines the very protection customers are paying for. The incident has therefore drawn attention well beyond the buyers directly affected.
2. The Flex bought at Singapore's Changi Airport
The first device is a Ledger Flex that Karpelès said was bought from Metapod, a reseller with stores at Singapore's Changi Airport. He first reported the finding on X on October 13. The implant inside, he said, had been customized for the Flex but relied on the same type of board and the same three-chip design seen in earlier cases.
In that design, one chip reads what appears on the device's screen, a second is a cellular modem, and a third is an eSIM that transmits the captured data. The screen is the weak point because a hardware wallet displays a recovery phrase when a user sets it up. A component that can read the display can copy those words, and a cellular connection lets it send them out without touching the computer or phone the user connects to.
The recovery phrase, typically 24 words, is the master key to a wallet. Anyone who holds it can recreate the wallet on another device and move the funds, which is why a leak of the phrase is far more serious than a leak of a password that can be reset.
A cellular modem with an eSIM is notable because it gives the implant its own route to the internet that is independent of the user's phone or computer. Security software on the user's own equipment cannot see that traffic, and the wallet's owner has no obvious way to notice it. The date of the first report, October 13, also falls only days after the drains reported on October 9, so the Flex finding arrived while the CryptoBilis episode was still unfolding.
3. The Nano X purchased from MediaMarkt in Germany
The second device is a Nano X bought at MediaMarkt in Germany by an X user named Johannes. He shared photos of his unit on October 11 and sent one unit to Karpelès and another to Ledger. Karpelès said his copy arrived on October 15 and contained an implant installed somewhat differently from those in the Southeast Asian units, although he called it surely the same implant.
Johannes later said that the store's other units appeared clean. Asked whether Johannes had found the only tampered units sold there, Karpelès said he would not be able to say for sure. The answer matters because a single tampered pair is very different from a stocked shelf of them, and the evidence available so far does not settle which one this is.
Johannes's decision to send one unit to Karpelès and the other to Ledger created two independent examinations of the same purchase, which is useful. If both examinations find the same hardware, it will be difficult to dispute; if they differ, the discrepancy itself would need explaining. Karpelès's timeline places the photos on October 11, the delivery of his unit on October 15 and his published findings the same day, so the technical review was done quickly.
4. What has Ledger said about the implant so far?
Ledger has said that all confirmed drains from the October 9 wave involve CryptoBilis devices. On October 13, MediaMarkt Saturn halted sales of Ledger products in alignment with the company, and Ledger also asked sellers in seven Asian markets, Singapore among them, to pause sales while the matter is examined.
In an October 14 post, Ledger said its team had inspected retail and distributor stock in Germany, including the stores named in the reports, and found no signs of tampering. It also said it had not yet been able to inspect the devices shown online. Those two statements are consistent with each other: a clean sample of shelf stock does not rule out that a small number of individual units were altered, and a device that Ledger has not examined cannot be cleared or confirmed by it.
The company's position, then, is that the confirmed losses trace to one seller, while the new reports remain under review. Karpelès's claim and Ledger's findings point in different directions, and the physical examination of the German unit sent to Ledger is likely to carry the most weight.
The sales pause by MediaMarkt Saturn, a large European electronics retailer, shows the commercial effect of the reports even before any test results. Retailers have little to gain from continuing to sell a product that customers fear, and a halt coordinated with Ledger signals that both sides prefer caution while the facts are clarified.
5. Why does "made for mass production" matter?
Karpelès argues that the implant has changed in form. Earlier versions, he said, were boards wired into the device by hand. The newest are blank boards that clip into place, and on the Nano X the board will essentially fall into position. He said the developers spent months on research and development and had substantial funding.
That evolution, if accurate, changes the economics of hardware attacks. Implants of this kind were once expensive and aimed at narrow targets, such as a particular wealthy individual. A clip-in board that needs little skill to install can be fitted to many devices quickly, which makes broad campaigns against ordinary buyers feasible. Karpelès said he expects to see many more of them.
A supply chain attack of this sort is different from a software flaw. The manufacturer's firmware can be sound while a device is altered after it leaves the factory, somewhere between production and the customer. Resellers, distributors and shipping all form part of that chain, and so every handoff is a possible point of interference.
Detection is also a challenge. A buyer looking at a sealed or freshly opened device cannot see the chips inside without taking it apart, and Karpelès is a specialist who examines hardware as part of his work. Ordinary owners are unlikely to open a device, so any practical defense has to operate before purchase, through trusted channels and packaging, or after purchase, by limiting how much value any one device holds.
6. Should Ledger end its authorized reseller program?
Asked that question, Karpelès said ending the program would probably be too drastic. He suggested tamper-evident packaging instead, meaning seals or packaging that visibly show if a box has been opened before reaching the buyer.
Packaging is a modest but practical defense because it targets the moment of greatest risk. If the seal on a new device is broken, missing or looks different from what the maker describes, the buyer has a reason to refuse the product. It does not help against tampering done before packaging, but it narrows the places where an attacker can work unseen.
Authorized resellers give customers convenience and local availability, and removing them would cut access in many regions, which helps explain why he favors a narrower fix.
Splitting funds across several devices and keeping backups in separate places are common precautions that limit the damage if one wallet is compromised. Setups that require more than one signature before a transaction can proceed go further, because an attacker would then need to compromise multiple devices at once. These measures do not stop an implant, but they reduce what a single tampered unit can cost its owner.
7. What happens next?
The immediate step is Ledger's inspection of the Nano X that Johannes sent to the company. Its result would show whether the German unit carries the same implant Karpelès describes. The extent of the sales pauses in Germany and across the seven Asian markets will also indicate how seriously the company is treating the new reports.
Until the examinations are complete, owners who bought a Ledger device from a reseller recently have a straightforward precaution available: check that packaging is intact and follows the maker's description, and never use a device that arrives with a pre-written recovery phrase or any sign of having been opened. The case also serves as a reminder that a hardware wallet protects keys only if the hardware itself can be trusted.