Ledger’s early implant warnings deserved more action, Karpelès says

Ledger was contacted about tampered hardware wallets risks months before its latest security crisis, with former Mt. Gox CEO Mark Karpelès questioning its response.

French hardware wallet maker Ledger received multiple reports of malicious hardware implants months before its latest security crisis, according to Mark Karpelès, former CEO of the collapsed Bitcoin exchange Mt. Gox.

Karpelès told Cointelegraph he was aware of at least two people who contacted Ledger about tampered devices dating back to December 2025. Karpelès said he hasn’t encountered any public warning Ledger issued in response.

Joe Grand, a security researcher, told Cointelegraph he alerted Ledger on March 4, 2026, about a malicious implant in a Nano X purchased through online marketplace Lazada Thailand in August 2025.

Grand said Ledger acknowledged his findings and said it was investigating internally, but he criticized the company for not proactively warning customers about the threat.

Vietnamese crypto educator Tai Zen contacted Ledger about a suspected hardware wallet implant in December 2025, according to Mark Karpelès. Source: Tai Zen

Ledger’s ongoing security crisis surfaced Oct. 9, when crypto losses were reported involving wallets sold through CryptoBilis, a reseller authorized in Southeast Asia. Ledger has confirmed that one affected device contained an unauthorized implant.

Ledger declined to comment when asked about its handling of Grand’s disclosure, and referred Cointelegraph to its public statements on X.

“Maybe Ledger not responding to a single event of an implant found on a Ledger purchased from a shady dealer is normal,” Karpelès said. He added: 

In a presentation shared with Cointelegraph, Grand identified the seller of the tampered Ledger as “LedgerXXX” on Lazada. At the time of writing, LedgerXXX is not listed as an authorized reseller in Thailand, though Lazada’s Ledger storefront is.

Cointelegraph sought clarification from both Grand and Ledger on the seller’s identity and authorization status when the device was purchased.

OneKey’s head of sales, Archie, told Cointelegraph that marketplaces such as Lazada host numerous independent sellers, making it difficult for customers to distinguish authorized stores from other listings.