Hidden implants in resold Ledger wallets tied to more than $86 million in thefts as chief executive and Karpelès dispute who is responsible

The dispute over Ledger's tampered hardware wallets has turned into an argument over disclosure. Ledger chief executive Pascal Gauthier and Mark Karpelès, the former chief executive of the collapsed Mt. Gox exchange, clashed publicly over security warnings after investigators linked hidden implants to more than $90 million in suspected thefts.

The attack exploited the supply chain. Ledger's secure chip itself was not compromised. Ledger confirmed that at least one device sold through CryptoBilis, an authorized reseller in Southeast Asia, contained an unauthorized hardware implant. Karpelès published images of a small circuit board under the screen. It carried a microcontroller, an antenna, a cellular modem and an eSIM, and it read the recovery phrase as the device displayed it and transmitted the phrase to the attacker. An attacker with the phrase can rebuild the wallet on any device and empty it at any time. The device's tamper-resistant chip provides no protection here, because the secret phrase is captured during setup, before the chip's protections apply.

Loss estimates range from more than $86 million, according to blockchain investigator Specter, to about $93.2 million from wallets bought through CryptoBilis in Indonesia, Malaysia and the Philippines. No recovery or attribution has been announced. The Block reports that the European retailer MediaMarkt suspended Ledger sales. Karpelès also says he found an implant in a Ledger Flex bought at Singapore's airport.

Ledger says its own systems and direct sales channels were not compromised, and it has told CryptoBilis buyers to stop using affected devices. Karpelès disputes the timeline. He says he knows of at least two reports sent to Ledger since December 2025, including one from hardware researcher Joe Grand on March 4, 2026, about a Nano X bought through Lazada Thailand, and that he saw no public warning before October. Ledger has an interest in limiting the problem to one reseller. Karpelès, whose reputation rests on the Mt. Gox collapse, has an interest in being the person who exposed it. The documented reports and the confirmed implant support the core claim that tampered units reached buyers through channels that Ledger authorized.