# Hidden implants in resold Ledger wallets tied to more than $86 million in thefts as chief executive and Karpelès dispute who is responsible

The implants read the 24-word recovery phrase during setup and send it out over a cellular eSIM, and Mark Karpelès says Ledger received reports as early as December 2025 without issuing a public warning.

- Published: 2026-10-19T05:41:35.249Z
- Canonical: https://polylog.news/crypto/2026-10-19/hidden-implants-in-resold-ledger-wallets-tied-to-more-than-8
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [crypto.news](https://crypto.news/ledger-ceo-clashes-with-ex-mt-gox-boss-over-90m-wallet-thefts/), [The Block](https://theblock.co/news/business/2026-10-13-ledger-confirms-hardware-implant-cryptobilis-reseller-units-mediamarkt-suspends-sales-europe-418442), [The Hacker News](https://thehackernews.com/2026/10/ledger-finds-unauthorized-hardware.html), [Crypto Briefing](https://cryptobriefing.com/ledger-cryptobilis-wallet-tampering-warning/), [Help Net Security](https://www.helpnetsecurity.com/?p=387570)

The dispute over Ledger's tampered hardware wallets has turned into an argument over disclosure. Ledger chief executive Pascal Gauthier and Mark Karpelès, the former chief executive of the collapsed Mt. Gox exchange, [clashed publicly over security warnings](https://crypto.news/ledger-ceo-clashes-with-ex-mt-gox-boss-over-90m-wallet-thefts/) after investigators linked hidden implants to more than $90 million in suspected thefts.

The attack exploited the supply chain. Ledger's secure chip itself was not compromised. Ledger confirmed that at least one device sold through CryptoBilis, an authorized reseller in Southeast Asia, [contained an unauthorized hardware implant](https://theblock.co/news/business/2026-10-13-ledger-confirms-hardware-implant-cryptobilis-reseller-units-mediamarkt-suspends-sales-europe-418442). Karpelès published images of a small circuit board under the screen. It carried a microcontroller, an antenna, a cellular modem and an eSIM, and it [read the recovery phrase as the device displayed it and transmitted the phrase to the attacker](https://www.helpnetsecurity.com/?p=387570). An attacker with the phrase can rebuild the wallet on any device and empty it at any time. The device's tamper-resistant chip provides no protection here, because the secret phrase is captured during setup, before the chip's protections apply.

Loss estimates range from [more than $86 million, according to blockchain investigator Specter](https://thehackernews.com/2026/10/ledger-finds-unauthorized-hardware.html), to about $93.2 million from wallets bought through CryptoBilis in Indonesia, Malaysia and the Philippines. No recovery or attribution has been announced. The Block reports that the European retailer MediaMarkt suspended Ledger sales. Karpelès also says he found an implant in a Ledger Flex bought at Singapore's airport.

Ledger says its own systems and direct sales channels were not compromised, and it has told CryptoBilis buyers to [stop using affected devices](https://cryptobriefing.com/ledger-cryptobilis-wallet-tampering-warning/). Karpelès disputes the timeline. He says he knows of at least two reports sent to Ledger since December 2025, including one from hardware researcher Joe Grand on March 4, 2026, about a Nano X bought through Lazada Thailand, and that he saw no public warning before October. Ledger has an interest in limiting the problem to one reseller. Karpelès, whose reputation rests on the Mt. Gox collapse, has an interest in being the person who exposed it. The documented reports and the confirmed implant support the core claim that tampered units reached buyers through channels that Ledger authorized.

## What this means

The weak point is the distribution chain between the factory and the buyer, and hardware-wallet makers do not control it the way they control firmware. That leaves self-custody holders who buy from resellers, marketplaces or airport shops exposed, along with Ledger's brand value. Buyers in Southeast Asia, where reseller channels dominate, carry the largest share of the risk. The market has been treating this as one reseller's crime. If Karpelès's Singapore and European findings hold up, it is a channel-wide problem. The likelier outcome over the coming months is that hardware-wallet makers move toward devices that buyers can check for tampering, sell more through direct channels only, and adopt setup flows that never show the full recovery phrase on screen. Meanwhile, part of the cautious capital that held its own keys moves to custodial accounts and exchange-traded funds. This read would be wrong if the confirmed implants stay limited to CryptoBilis units and Ledger shows that the earlier reports were handled and contained.

## What to watch

- Whether Ledger or independent researchers confirm implants in devices sold outside CryptoBilis, such as the Singapore Flex or the MediaMarkt units. Confirmation would show the attack can reach any retail channel.
- Whether Ledger publishes how it handled the December 2025 and March 2026 reports. Its answer will decide whether regulators in Europe or Asia treat this as a product-safety and disclosure failure.
- Movement of the stolen funds into exchanges or mixers. Freezes or attribution there are the only route to recovery for victims.