Karpeles Says Ledger Got Hardware Implant Warnings in December 2025 and Never Warned Customers
Published October 17, 2026, 20:45 PKT. Based on Cointelegraph's October 16, 2026 reporting (primary source), CoinEdition's October 16, 2026 coverage (secondary source), CoinCentral (secondary source), and Newisty (secondary source).
Ledger received warnings about tampered hardware wallets as early as December 2025 and never issued a public warning in response, according to Mark Karpelès, the former CEO of the collapsed Bitcoin exchange Mt. Gox. Karpelès told Cointelegraph on October 16, 2026 that he knew of at least two people who contacted the French wallet maker about suspect devices, a claim relayed the same day by Wu Blockchain.
The December 2025 warnings
Karpelès told Cointelegraph he was aware of at least two instances of people contacting Ledger about tampered devices dating back to December 2025, and that he had not seen any public warning from the company responding to those early reports. One of the early reporters was Vietnamese crypto educator Tai Zen, who contacted Ledger about a suspected hardware wallet implant in December 2025, according to Karpelès. "Maybe Ledger not responding to a single event of an implant found on a Ledger purchased from a shady dealer is normal," Karpelès said. "However the increasing number of reports they must have received, and the increasing quality/technology used should have alerted them enough to act, and at least remind customers to be careful."
Joe Grand's March 2026 Nano X alert
Security researcher Joe Grand separately told Cointelegraph he alerted Ledger on March 4, 2026, about a malicious implant in a Ledger Nano X he had bought through Lazada Thailand in August 2025. Grand said Ledger acknowledged his findings and said it was investigating internally, but he criticized the company for not proactively warning customers about the threat. When Cointelegraph asked how Ledger handled Grand's disclosure, the company declined to comment and referred the outlet to its public statements on X, according to the report.
The LedgerXXX seller on Lazada
The Nano X that Grand examined came from a Lazada merchant named "LedgerXXX," which does not appear on Ledger's list of authorized resellers in Thailand, CoinEdition reported, even though Lazada hosts Ledger's official storefront. Archie, the head of sales at rival wallet maker OneKey, told Cointelegraph that marketplaces like Lazada host many independent sellers, making it hard for customers to tell authorized stores from unauthorized ones. OneKey has since removed its reseller listings to carry out stricter checks, according to the report.
The crisis the warnings preceded
Ledger's current security crisis surfaced on October 9, 2026, when crypto losses were reported involving wallets sold through CryptoBilis, a reseller authorized in Southeast Asia. Ledger confirmed on October 10 that one affected device contained an unauthorized hardware implant. About $90 million was reportedly stolen from tampered Ledger wallets sold by CryptoBilis, according to Santiment data cited by CoinCentral, though Ledger has not verified the total. CoinCentral reported that the hidden LTE implants copied the wallet's 24-word recovery phrase during setup and sent it out over an eSIM. Ledger says users who set up a CryptoBilis device should move their funds to a new device with a new recovery phrase, according to its public statements.
This article is news reporting and is not investment advice.
Sources
- Cointelegraph, October 16, 2026, primary source: direct interviews with Mark Karpelès (at least two people contacted Ledger about tampered devices dating back to December 2025, including Vietnamese educator Tai Zen; no public warning seen; Karpelès's on-the-record quote on Ledger's handling) and Joe Grand (March 4, 2026 alert on a malicious implant in a Nano X bought through Lazada Thailand in August 2025; Ledger acknowledged and said it was investigating; criticism of the missing customer warning); Ledger declined to comment on Grand's disclosure and referred Cointelegraph to its public statements on X
- CoinEdition, October 16, 2026, secondary source: Karpelès's December 2025 claims; Grand's Nano X came from Lazada seller "LedgerXXX," absent from Ledger's authorized reseller list in Thailand; the October 9 CryptoBilis loss reports and October 10 implant confirmation
- CoinCentral, October 2026, secondary source: Santiment's approximately $90 million theft estimate, with Ledger not having verified the total; hidden LTE implants copying 24-word recovery phrases and transmitting them over eSIM; Ledger's guidance to move funds to a new device with a new recovery phrase
- Newisty, October 2026, secondary source: OneKey head of sales Archie on Lazada's independent-seller verification gaps; OneKey removing its reseller listings for stricter checks
MABOnChain Daily Brief
The key crypto and markets stories in one short, plain-language email. Free. Unsubscribe any time.
Prefer chat? Join us on Telegram Watch on YouTube
Keep reading
France's Assembly Backs 31.4% Tax on Crypto-to-Stablecoin Swaps, Still Three Votes From Law
France's National Assembly adopted amendment I-3898 on October 16, 2026, which would make swapping crypto into MiCA-regulated stablecoins like USDC and EURC a taxable event from January 1, 2027, at the country's 31.4% flat capital-gains rate. The measure still needs three more votes, including Senate review, to become law.
CENTCOM Chief Cooper Says U.S. Froze $350M in Iranian Crypto as Blockade Costs Tehran $25B
U.S. Central Command chief Adm. Brad Cooper said on October 16, 2026 that the United States has frozen nearly $350 million in Iranian cryptocurrency assets in recent weeks, as a naval blockade he says cost Iran at least $25 billion in lost oil revenue squeezes Tehran. Axios reported the freeze involved the Treasury Department, and that CENTCOM has mostly paused strikes on Iranian positions on a White House order meant to avoid escalation before the U.S. midterm elections.
SEC's Atkins Pledges 'Back to Basics' Crypto Enforcement, Targeting Fraud and Real Investor Harm
SEC Chairman Paul Atkins and Enforcement Director David Woodcock told the agency's Material Matters podcast on October 16, 2026 that enforcement will go 'back to basics,' prioritizing fraud and real investor harm over case counts. Atkins said the agency will set 'clear expectations, clear rules' rather than regulating through enforcement.
Coinbase's Crypto-Backed Loans Hit $2.3 Billion as 17 Banks Move Deposits On-Chain
Coinbase reported $2.3 billion in crypto-backed loans outstanding on October 17, 2026, a product that launched in January 2025 and routes USDC loans through Morpho on Base. The exchange added fixed-rate loans via Morpho Midnight on September 22, widened collateral to XRP, DOGE, ADA and LTC in August, and partnered with Better on crypto-collateralized mortgages.
Bitget to Discontinue Services for Some Users in a One-Off Exercise, Says Funds Are Safe
Bitget said on October 17, 2026 that it will discontinue services for certain users as "a one-off exercise," stressing that user funds remain safe and the platform continues to operate normally. The exchange gave no number of affected accounts, no selection criteria and no reason.
Anthropic Says Claude Solved a 25-Year NSA Cryptography Seed Mystery in Under 30 Minutes
Anthropic published a research report on October 16, 2026 saying an internal Claude model traced the mysterious seeds behind five NIST elliptic curves, including P-256, to lrand48, a 1990s C-library random number generator seeded with a Unix timestamp. The model reproduced P-256's seed as candidate number 1,842 of a run started August 16, 1997, making a hidden backdoor in the curves much less likely, though Anthropic stresses the finding is not a break of ECDSA and nothing needs to change.