# Karpelès says Ledger documented spy implants in March as thefts from CryptoBilis-sold wallets pass $86 million Ledger has confirmed that tampered devices sent seed phrases out over a cellular link, so the standard advice to buy from an authorized reseller did not protect these buyers. - Published: 2026-10-18T05:40:05.953Z - Canonical: https://polylog.news/crypto/2026-10-18/karpel-s-says-ledger-documented-spy-implants-in-march-as-the - Publisher: Polylog (Crypto desk) - Section: crypto - Sources: [Polylog editors](https://polylog.news), [CryptoSlate](https://cryptoslate.com/who-handled-your-wallet-before-you-did/), [Bitcoin Magazine](https://bitcoinmagazine.com/news/scammer-lost-bitcoin-to-ledger-thieves), [BleepingComputer](https://bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts), [The Block](https://www.theblock.co/news/business/2026-10-09-ledger-cryptobilis-fund-losses-418163), [Blockonomi](https://blockonomi.com/ledger-faces-backlash-over-hardware-wallet-implant-warnings), [Protos](https://protos.com/german-ledger-reseller-pauses-sales-following-86m-draining-incident/) Mark Karpelès, the former chief executive of the collapsed Mt. Gox exchange, has spent recent weeks taking apart counterfeit and tampered hardware wallets. On Friday he said Ledger knew about advanced spy implants by March and that the company handled what he called "a five-alarm fire in the making" badly, [Cointelegraph reported](https://t.me/cointelegraph/72715). According to [Blockonomi](https://blockonomi.com/ledger-faces-backlash-over-hardware-wallet-implant-warnings), Karpelès says Ledger documented mass-produced, self-aligning implant designs in March 2026 but published only an educational Ledger Academy article. He claims that stronger public warnings could have prevented more than $90 million in losses. He does not dispute that the article existed, though its main advice was simply to buy devices directly from Ledger or from an authorized reseller. That advice offered no protection in this case. Ledger began investigating on October 9, after customers in Malaysia, Indonesia and the Philippines reported thefts from devices they had bought through CryptoBilis, an authorized Ledger reseller, [BleepingComputer reported](https://bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts). On October 10 the company confirmed that it had found an unauthorized hardware implant inside one affected customer's device. The modified devices captured seed phrases (the recovery words that control every key in a wallet) and sent them to an outside party over a cellular (LTE) connection. On-chain researchers estimate the suspected thefts at more than $86 million, [according to The Block](https://www.theblock.co/news/business/2026-10-09-ledger-cryptobilis-fund-losses-418163). [CryptoSlate's reconstruction](https://cryptoslate.com/who-handled-your-wallet-before-you-did/) notes that victims' devices still appeared to work normally when the funds disappeared. Ledger's position is narrower. The company says every confirmed case linked to the October 9 incident involved CryptoBilis devices, and it describes the number of affected units as limited. CryptoBilis has stopped selling hardware wallets, and a German reseller [paused its own sales](https://protos.com/german-ledger-reseller-pauses-sales-following-86m-draining-incident/) after the incident. Karpelès has said that one device he examined carried an implant hidden under its screen that still passed Ledger's authenticity check. Protos reports that no evidence yet links that particular device to CryptoBilis. The ownership of the reseller adds a second thread. A [statement relayed by KuCoin News](https://www.kucoin.com/news/flash/over-86m-in-crypto-stolen-via-ledger-s-authorized-dealer-cryptobilis) says CryptoBilis was acquired in March 2026, that its original shareholders then left operations, and that confidentiality terms prevent the original team from announcing the transaction before October 19. That is the same month Karpelès says Ledger documented the implant designs. No source has shown a connection between the two. More incidents tied to the case have emerged. Protos has reported [phishing campaigns that push a fake Ledger firmware update](https://protos.com/phishing-scammers-capitalise-on-ledger-panic-with-fake-firmware-update/) to worried owners. Separately, Chainalysis found that one victim, who lost about $5 million in bitcoin, [was a scammer himself](https://bitcoinmagazine.com/news/scammer-lost-bitcoin-to-ledger-thieves), Bitcoin Magazine reported. Each side has a stake in its version. Karpelès gains credibility as the person who found the problem first. Ledger has a commercial reason to limit the incident to one reseller in one region. ## What this means A hardware wallet's security rests on its secure chip. An implant on the circuit board that captures the seed phrase outside that chip bypasses that protection entirely, and Karpelès's claim that a tampered unit passed the authenticity check implies that the check verifies the chip but not the board around it. The people exposed are buyers who depend on third-party resellers, mostly in emerging markets where direct shipping is slow or costly, along with Ledger's retail business and its competitors' reseller networks. The nearest precedent is Ledger's 2020 customer-database leak. It led to years of phishing and physical extortion attempts, but it did not end Ledger's market position. This case is different because the official distribution channel itself was compromised. The desk's read is that within weeks to months Ledger and its rivals will tighten distribution through direct shipping, fewer authorized resellers, and some form of board-level or user-run verification, and that risk-averse holders in affected markets will move part of their holdings to exchanges and regulated custodians. That forecast holds if tampered units stay limited to one compromised channel. It would be proven wrong, in a far worse scenario, if implants turn up in devices shipped directly from Ledger, which would call the product line itself into question rather than its supply chain. ## What to watch - Whether CryptoBilis names its March 2026 buyer after October 19, because that would show whether the compromise came from inside the distribution channel. - Whether Ledger introduces a way for owners to verify the circuit board itself, since a check that only verifies the chip would not catch this kind of tampering. - Confirmed tampered units outside Southeast Asia, which would show this is a supply problem across several regions rather than one rogue reseller.