Karpeles says Ledger's initial warnings about the implant deserved more action

Ledger was contacted about the dangers of tampered hardware wallets months before the latest security crisis, and Mark Karpeles, former CEO of Mt. Gox questioned its response.

According to Mark Karpelès, the former CEO of the fallen Bitcoin exchange Mt. Gox, the maker of the French ledger hardware wallet, received several reports of malicious hardware being planted months before its latest security crisis.

Karpeles told Cointelegraph that he was aware of at least two people who contacted Ledger about tampered devices dating back to December 2025.

Joe Grand, a security researcher, told Cointelegraph that he alerted Ledger on March 4, 2026 about a malicious implant in the Nano X purchased through Thailand's online marketplace Lazada in August 2025.

Grande said Ledger confirmed its findings and said it was investigating internally, but he criticized the company for not proactively warning customers about the threat.

According to Mark Karpelès, Vietnamese cryptocurrency guru Tai Zen contacted Ledger in December 2025 about planting a suspicious hardware wallet. Source: Tai Zen

The ongoing security crisis of the ledger came to light on October 9, when cryptocurrency losses related to wallets sold through CryptoBilis, an authorized dealer in Southeast Asia, were reported. Ledger has confirmed that an affected device contains an unauthorized implant.

Ledger declined to comment on how it handled the Grand disclosures, referring Cointelegraph to its public statements on X.

"Maybe it's normal for a ledger not to respond to an implant found in a ledger bought from a shady vendor," Karpeles said. He added:

In a presentation shared with Cointelegraph, Grand identified the seller of the tampered ledger as “LedgerXXX” on Lazada. At the time of writing, LedgerXXX is not listed as an authorized seller in Thailand, although Ledger's storefront is Lazada.

Cointelegraph sought clarification from Grand and Ledger on the seller's identity and licensing status when purchasing the device.

OneKey's head of sales, Archie, told Cointelegraph that marketplaces like Lazada host multiple independent sellers, making it difficult for customers to distinguish authorized stores from other listings.

After the recent incidents, OneKey removed its vendor listings pending stricter reviews, saying that manufacturers should take responsibility for protecting customers and not rely solely on buyers to identify trusted vendors.

Grand's findings were not limited to Ledger. In August 2026, he also warned Trezor about tampered Trezor One and Model T wallets purchased from unauthorized sellers on TikTok and Facebook.

Trezor told Cointelegraph that counterfeit wallets occasionally appear through unauthorized sellers, as it warned in 2022 about modified devices sold on Russian markets. The company said its recent claim of no evidence of device damage only applies to new wallets sold through authorized resellers.

However, Trezor said it treats reports of unauthorized sellers as early warnings and uses researchers' findings to improve security checks.

"What changes the picture is a new technique or the first one that comes through an authorized channel," Trezor said. "Each one means the problem is closer to ordinary shoppers, and that's when we'll move the fastest, including alerting customers directly."