Ledger’s early implant warnings deserved more action, Karpelès says

French hardware wallet maker Ledger received multiple reports of malicious hardware implants months before its latest security crisis, according to Mark Karpelès, former CEO of the collapsed Bitcoin exchange Mt. Gox.

Karpelès told Cointelegraph he was aware of at least two people who contacted Ledger about tampered devices dating back to December 2025. Karpelès said he hasn’t encountered any public warning Ledger issued in response.

Joe Grand, a security researcher, told Cointelegraph he alerted Ledger on March 4, 2026, about a malicious implant in a Nano X purchased through online marketplace Lazada Thailand in August 2025.

Grand said Ledger acknowledged his findings and said it was investigating internally, but he criticized the company for not proactively warning customers about the threat.

Vietnamese crypto educator Tai Zen contacted Ledger about a suspected hardware wallet implant in December 2025, according to Mark Karpelès. Source: Tai Zen

Ledger’s ongoing security crisis surfaced Oct. 9, when crypto losses were reported involving wallets sold through CryptoBilis, a reseller authorized in Southeast Asia. Ledger has confirmed that one affected device contained an unauthorized implant.

Ledger declined to comment when asked about its handling of Grand’s disclosure, and referred Cointelegraph to its public statements on X.

“Maybe Ledger not responding to a single event of an implant found on a Ledger purchased from a shady dealer is normal,” Karpelès said. He added:

However the increasing number of reports they must have received, and the increasing quality/technology used should have alerted them enough to act, and at least remind customers to be careful.”

Marketplace listings expose reseller verification gaps

In a presentation shared with Cointelegraph, Grand identified the seller of the tampered Ledger as “LedgerXXX” on Lazada. At the time of writing, LedgerXXX is not listed as an authorized reseller in Thailand, though Lazada’s Ledger storefront is.

Cointelegraph sought clarification from both Grand and Ledger on the seller’s identity and authorization status when the device was purchased.

OneKey’s head of sales, Archie, told Cointelegraph that marketplaces such as Lazada host numerous independent sellers, making it difficult for customers to distinguish authorized stores from other listings.

Source: Grand Idea Studio (Joe Grand)

Related: Can crypto users trust the supply chain behind hardware wallets?

Following the recent incidents, OneKey removed its reseller listings pending stricter checks, saying manufacturers must take responsibility for protecting customers rather than relying solely on buyers to identify trustworthy sellers.