Karpelès Says Ledger Received Suspected Implant Reports Before Crisis

Former Mt. Gox CEO Mark Karpelès said Ledger received at least two reports of suspected hardware-wallet tampering before an Oct. 9, 2026, incident involving wallets sold through CryptoBilis raised questions about customer warnings.

Karpelès said the reports involved people who contacted Ledger as early as December 2025. He identified Vietnamese crypto educator Tai Zen as one person who contacted the company that month about a suspected implant.

Security researcher Joe Grand said he contacted Ledger on March 4, 2026, after finding an implant in a Nano X he bought through Lazada Thailand in August 2025. Grand said Ledger acknowledged his findings and told him it was investigating internally. His presentation identified the Lazada seller as “LedgerXXX.” In October 2026, “LedgerXXX” was absent from Ledger’s authorized Thai reseller list, while Lazada’s Ledger storefront appeared on it.

Karpelès said he had not seen a public warning from Ledger in response. He argued the number and technical sophistication of the reports “should have alerted them enough to act.”

The latest security incident surfaced Oct. 9, 2026, amid crypto losses involving wallets sold through CryptoBilis, an authorized reseller in Southeast Asia. Ledger confirmed an affected device contained an unauthorized implant. The incident is part of Ledger’s investigation into losses tied to CryptoBilis-sold devices.

Grand also alerted Trezor in August 2026 about tampered Trezor One and Model T wallets sold through unauthorized sellers on TikTok and Facebook. Trezor said its statement that it had no evidence of compromised devices applied only to new wallets sold through authorized resellers. The company described reports involving unauthorized sellers as early warnings and said a new technique or a case through an authorized seller would prompt a faster response, including direct customer warnings.

Trezor also said counterfeit wallets sometimes appear through unauthorized sellers and cited its 2022 warning about altered devices sold on Russian marketplaces. OneKey removed its reseller listings pending stricter checks.