Karpelès Says Ledger Warnings Could Have Prevented More Than $90M
A six-chain tally found $102 million in wallet outflows, but Ledger has not confirmed that amount as losses.

Former Mt. Gox CEO Mark Karpelès says Ledger could have prevented more than $90 million in losses by warning customers more forcefully about hardware wallet implants, a claim that highlights the difference between traced outflows and confirmed losses.
A six-chain tally counted $102 million in outflows from 335 wallets through Oct. 16 at 10:40 a.m. ET (14:40 UTC). The activity covered Bitcoin, Ethereum, TRON, BNB Chain, Polygon and Solana, with assets valued at prices from the morning of Oct. 9. The tally exceeds an initial $86 million estimate because it included other chains and addresses missing from the first public lists. It also counted $10 million in Tether (USDT) frozen by Tether; a freeze does not mean the funds have been returned to users. Ledger has not confirmed an aggregate loss figure or that all traced outflows resulted from implants.
Grand said his March 4, 2026, message to Ledger concerned an implant in a Nano X he had bought from Lazada Thailand the previous August. Grand said Ledger acknowledged his findings and opened an internal investigation. Karpelès has also said Ledger received suspected implant reports before the CryptoBilis-linked incident, as described in his earlier account of suspected implant reports.
Ledger's buyer guide was first published March 6, 2026, and shows a Sept. 18 update. The guide describes the Genuine Check as an authentication step for the Secure Element; it says the check cannot reveal physical tampering when that chip remains genuine. The guide recommends buying directly from Ledger or an authorized reseller. That check can authenticate the chip without establishing that other parts of a device have remained physically unchanged.
Ledger confirmed that one affected customer's device contained an unauthorized implant. The company says the attack targeted devices after they left its control and that its chip, operating system and servers were not compromised. Karpelès said the reports “should have alerted them enough to act, and at least remind customers to be careful.” His estimate of preventable losses is separate from the on-chain tally, which measures outflows rather than confirmed losses.