Karpelès questions Ledger's response to early hardware tampering alerts
Mark Karpelès, who previously led Mt. Gox as CEO, reveals that Ledger was notified by multiple individuals regarding malicious hardware modifications, sparking concerns about the company's handling of advance warnings.
Ledger, the France-based manufacturer of hardware cryptocurrency wallets, was notified about malicious hardware tampering on several occasions well in advance of its current security controversy, according to statements from Mark Karpelès, the former chief executive of the defunct Bitcoin trading platform Mt. Gox.
In his conversation with Cointelegraph, Karpelès indicated that he had knowledge of no fewer than two individuals who reached out to Ledger regarding compromised devices as far back as December 2025. According to Karpelès, he has not observed any public advisory or warning statement issued by Ledger in the aftermath of these reports.
Security expert Joe Grand informed Cointelegraph that he notified Ledger on March 4, 2026, regarding a malicious hardware modification discovered in a Nano X device that had been acquired via the e-commerce platform Lazada Thailand during August 2025.
According to Grand, Ledger confirmed receipt of his security findings and indicated that an internal investigation was underway, though he expressed disappointment with the company's failure to issue proactive customer alerts regarding this security threat.
The current security crisis facing Ledger came to light on Oct. 9, following reports of cryptocurrency theft involving hardware wallets distributed by CryptoBilis, a Southeast Asian reseller operating with Ledger's authorization. The company has verified that at least one compromised device was found to contain an unauthorized hardware implant.
When questioned about its response to Grand's security disclosure, Ledger chose not to provide direct commentary and instead directed Cointelegraph to review its official statements published on X.
"Perhaps it's understandable that Ledger didn't respond to an isolated incident involving an implant discovered in a Ledger device obtained from a questionable seller," Karpelès remarked. He continued:
However the increasing number of reports they must have received, and the increasing quality/technology used should have alerted them enough to act, and at least remind customers to be careful.
Marketplace listings expose reseller verification gaps
Within a presentation provided to Cointelegraph, Grand named the vendor of the compromised Ledger device as "LedgerXXX" operating on the Lazada platform. As of this publication, LedgerXXX does not appear on the list of authorized Thai resellers, although Lazada's official Ledger storefront does hold authorized status.
Cointelegraph requested additional clarification from both Grand and Ledger regarding the seller's identity and whether they held authorized reseller status at the time the device was originally purchased.
Archie, who serves as head of sales for OneKey, explained to Cointelegraph that e-commerce platforms like Lazada accommodate many independent vendors, creating challenges for customers attempting to differentiate between officially authorized stores and other vendor listings.
In response to the recent security incidents, OneKey made the decision to remove its reseller listings while implementing more rigorous verification procedures, emphasizing that manufacturers bear the responsibility for safeguarding customers rather than placing the burden entirely on purchasers to identify legitimate sellers.
Unauthorized wallet sales still raise security concerns
The scope of Grand's security discoveries extended beyond Ledger products. In August 2026, he similarly notified Trezor about tampered Trezor One and Model T hardware wallets that had been purchased from unauthorized vendors operating on TikTok and Facebook.
Trezor informed Cointelegraph that counterfeit hardware wallets periodically emerge through unauthorized distribution channels, referencing its 2022 warning about modified devices being sold through Russian online marketplaces. The company clarified that its recent statement indicating no evidence of compromised devices pertained exclusively to newly manufactured wallets distributed through authorized reseller networks.
Nevertheless, Trezor emphasized that it regards all reports involving unauthorized sellers as valuable early warning signals and leverages researchers' discoveries to enhance its security verification protocols.
"What changes the picture is a new technique, or a first case coming through an authorised channel," Trezor said. "Either one means the problem has moved closer to ordinary buyers, and that's when we'd move fastest, including warning customers directly."