1. What did Karpelès say about Ledger's handling of the implant reports?
Mark Karpelès, the former chief executive of the Mt. Gox exchange, said on October 16 that French hardware wallet maker Ledger received several reports of malicious implants in its devices months before the company's current security crisis became public. He argued that the accumulating warnings called for a firmer response, at least a public reminder to customers.
Karpelès said he knows of at least two people who got in touch with Ledger about tampered devices as early as December 2025. He added that he has found no public warning from the company issued in response to those contacts. His comments put pressure on Ledger at a moment when the firm is already dealing with confirmed thefts tied to compromised wallets.
The criticism is notable because Karpelès is not an outside commentator with no stake in the matter. As the former head of one of the earliest large Bitcoin exchanges, he has spent years in the public conversation about custody failures. His argument is not that Ledger caused the tampering, but that the company had enough information to act sooner.
2. How did the current Ledger crisis begin?
The present episode surfaced on October 9, when crypto losses were reported in connection with wallets sold through CryptoBilis, an authorized Ledger reseller in Southeast Asia. Ledger later confirmed that at least one of the affected devices contained an unauthorized hardware implant, meaning a component added to the wallet that was never part of the manufacturer's design.
A hardware wallet is meant to keep the private keys that control a user's coins on a dedicated device, away from internet-connected computers and phones. Its security rests on a simple assumption: the device a customer unboxes is the device the manufacturer built. An implant breaks that assumption. If an attacker can alter a unit before it reaches the buyer, the owner may set up the wallet and deposit funds with no outward sign that anything is wrong.
That is why supply-chain tampering is regarded as one of the hardest threats for hardware wallet makers to counter. The software can be correct and the secure chip can be genuine, and the device can still be compromised by something added around them. Detection often depends on physically inspecting the unit, which ordinary buyers are rarely able to do.
3. What did earlier warnings look like?
One of the earlier reports Karpelès points to came from Tai Zen, a Vietnamese crypto educator, who reportedly contacted Ledger in December 2025 about a suspected implant. The article that prompted this discussion includes a screenshot of a post by Tai Zen on the social platform X. Karpelès cited the contact as one of the two he knows about from that month.
A second, more detailed report came from Joe Grand, a security researcher. He told Ledger about an implant found in a Nano X that had been purchased through Lazada Thailand in August 2025. According to the account Karpelès relies on, Ledger acknowledged Grand's findings and said it was investigating the matter internally. Grand has since criticized the company for not warning customers proactively.
Grand's presentation materials describe the seller of the device as "LedgerXXX" on Lazada. That name does not appear as an authorized Ledger reseller in Thailand, although Lazada's Ledger storefront itself is listed. Questions sent to Grand and Ledger asking them to clarify who the seller was and whether it had any authorization went unanswered in the reporting available so far.
Ledger declined to comment on how it handled Grand's disclosure. It pointed instead to the statements it has already published on X.
4. Why does Karpelès think more should have been done?
Karpelès accepts that a single report involving a doubtful dealer might reasonably be set aside. Buyers who purchase from unofficial sellers take on risks that a manufacturer cannot fully control, and a lone complaint can be hard to separate from noise.
His position changes once the reports multiply and the tampering looks more sophisticated. In that situation, he argues, the company should have treated the pattern as a signal. Even a modest step, such as a customer reminder urging people to be careful about where they buy, would have cost little and might have reduced harm.
The disagreement is therefore about thresholds. Ledger had received reports, but the open question is how many, and of what kind, are needed before a warning to the public is justified. Karpelès believes that line was crossed before October. Ledger has not said publicly where it believes the line sits.
5. Why do implant reports matter so much for a hardware wallet?
A hardware wallet differs from an exchange account or a mobile app in one respect that shapes this whole dispute: the customer is asked to trust a physical object. Software wallets can be inspected, reinstalled or replaced in minutes. A hardware device is sealed, built around a dedicated chip, and sold with the promise that the secret it protects never leaves it.
Because of that promise, a single confirmed case of tampering carries more weight than a typical bug report. An implant is not a flaw in the product as designed. It is an added component that can sit between the user and the device's protections, and it may be invisible to the checks a customer can run. When several independent owners raise the same suspicion, the manufacturer has a reason to ask whether the issue is isolated or part of a campaign.
The size of the potential harm also differs from other security issues. Funds held on a compromised wallet can be drained once and cannot be recalled, since blockchain transfers are final. That makes the period between the first warning and the first public notice the most valuable time for prevention, and it is the interval Karpelès is asking Ledger to explain.
Manufacturers face a genuine trade-off. Warning the public too early about an unconfirmed report can alarm customers and harm legitimate resellers. Warning too late leaves buyers exposed. Neither Karpelès nor the wallet makers quoted here claim the balance is easy to strike; the argument is about where the balance should sit once reports start to repeat.
6. Is the problem limited to Ledger?
The wider hardware wallet industry has run into the same difficulty, which is that unauthorized sellers on large online marketplaces can sell altered devices that look legitimate. Other manufacturers have described their own experience in the days since the Ledger news.
OneKey, a hardware wallet maker, said through its head of sales, Archie, that marketplaces host many independent sellers, which makes it hard for buyers to tell which stores are authorized. The company argued that manufacturers have to protect customers rather than rely on buyers to verify sellers. OneKey has removed its reseller listings while it puts stricter checks in place.
Trezor, another maker, said that in August 2026 Grand alerted it to tampered Trezor One and Model T devices that had been bought from unauthorized sellers on TikTok and Facebook. Trezor said counterfeits occasionally appear through unauthorized sellers and recalled that in 2022 it had warned about modified devices on Russian marketplaces. The company stressed that its claim of having no compromised devices applies only to new wallets bought from authorized resellers.
Trezor also set out how it decides when to act. It treats reports about unauthorized sellers as early warnings that help it improve its checks. A new attack technique, or a case that arises through an authorized sales channel, would lead it to move faster, including by warning customers directly.
7. How can buyers reduce the risk of a tampered wallet?
The most reliable precaution is to buy a hardware wallet directly from the manufacturer or from a reseller the manufacturer lists on its own website. Marketplace storefronts can look official while being run by third parties, as the questions around the Lazada listing show.
Buyers should also treat any wallet that arrives already initialized, with a recovery phrase supplied, or with damaged packaging as untrustworthy. A recovery phrase should always be generated by the device itself during setup and never taken from a card or note included in the box.
Anyone who suspects a unit has been altered should not deposit funds, and should move existing holdings to a new device with a freshly generated recovery phrase. Even so, the Karpelès criticism is a reminder that individual caution can only go so far when tampering is hard to see.
8. What happens next for Ledger?
Several questions remain open. Ledger has not publicly explained its handling of the earlier reports, and the identity and status of the seller named in Grand's materials has not been settled in public. The company's own statements on X remain its main channel for updates.
The episode also leaves the industry with a policy question. Trezor's approach, which ties direct customer warnings to new techniques or compromises through authorized channels, and Karpelès's call for earlier reminders to buyers describe two different standards. How manufacturers resolve that difference, and how closely they supervise the resellers carrying their names, will shape customer trust in hardware wallets after this episode.
For owners, the practical consequence is straightforward. Hardware wallets remain a widely used way to hold digital assets outside exchanges, but the Ledger implant case shows that the safety of such a device begins with where it was bought. Until manufacturers set out clearer rules for warning customers, buyers are likely to keep scrutinizing sellers more closely than they have before.