Karpelès says Ledger documented spy implants in March as thefts from CryptoBilis-sold wallets pass $86 million

Mark Karpelès, the former chief executive of the collapsed Mt. Gox exchange, has spent recent weeks taking apart counterfeit and tampered hardware wallets. On Friday he said Ledger knew about advanced spy implants by March and that the company handled what he called "a five-alarm fire in the making" badly, Cointelegraph reported. According to Blockonomi, Karpelès says Ledger documented mass-produced, self-aligning implant designs in March 2026 but published only an educational Ledger Academy article. He claims that stronger public warnings could have prevented more than $90 million in losses. He does not dispute that the article existed, though its main advice was simply to buy devices directly from Ledger or from an authorized reseller.

That advice offered no protection in this case. Ledger began investigating on October 9, after customers in Malaysia, Indonesia and the Philippines reported thefts from devices they had bought through CryptoBilis, an authorized Ledger reseller, BleepingComputer reported. On October 10 the company confirmed that it had found an unauthorized hardware implant inside one affected customer's device. The modified devices captured seed phrases (the recovery words that control every key in a wallet) and sent them to an outside party over a cellular (LTE) connection. On-chain researchers estimate the suspected thefts at more than $86 million, according to The Block. CryptoSlate's reconstruction notes that victims' devices still appeared to work normally when the funds disappeared.

Ledger's position is narrower. The company says every confirmed case linked to the October 9 incident involved CryptoBilis devices, and it describes the number of affected units as limited. CryptoBilis has stopped selling hardware wallets, and a German reseller paused its own sales after the incident. Karpelès has said that one device he examined carried an implant hidden under its screen that still passed Ledger's authenticity check. Protos reports that no evidence yet links that particular device to CryptoBilis.

The ownership of the reseller adds a second thread. A statement relayed by KuCoin News says CryptoBilis was acquired in March 2026, that its original shareholders then left operations, and that confidentiality terms prevent the original team from announcing the transaction before October 19. That is the same month Karpelès says Ledger documented the implant designs. No source has shown a connection between the two.

More incidents tied to the case have emerged. Protos has reported phishing campaigns that push a fake Ledger firmware update to worried owners. Separately, Chainalysis found that one victim, who lost about $5 million in bitcoin, was a scammer himself, Bitcoin Magazine reported. Each side has a stake in its version. Karpelès gains credibility as the person who found the problem first. Ledger has a commercial reason to limit the incident to one reseller in one region.