MABOnChain
Educational content only. Nothing on this site is financial advice.
Home / Scam Alerts / Ledger CEO Pascal Gauthier Clashes With Karpeles Over $90M Hardware Wallet Implants
Scam Alerts

Ledger CEO Pascal Gauthier Clashes With Karpeles Over $90M Hardware Wallet Implants

By MABOnChain Desk · Published · Updated · 5 min read

Editorial digital-art illustration in the CoinTelegraph style: two imposing armored figures facing each other across a cracked-open hardware wallet device lying on a dark stage under dramatic spotlights, cold steel-blue tones on one side and harsh red-amber tones on the other, the opened wallet revealing a sinister hidden circuit-board implant with glowing traces and a tiny antenna, electric sparks flying, scattered golden coins and broken key fragments, cracked magnifying glass, deep navy background with volumetric light rays, cinematic gritty editorial mood, ultra-detailed 16:9 wide composition, no text.

Published October 19, 2026, 6:55 AM PKT. Based on X posts by Ledger CEO Pascal Gauthier and former Mt. Gox CEO Mark Karpeles on October 17, 2026 (primary sources), and October 17-18, 2026 reporting by TokenPost, AMBCrypto, BeInCrypto and Coinotag (secondary sources). This is a follow-up to MABOnChain's October 17, 2026 report, in which Karpeles said Ledger received hardware implant warnings as early as December 2025 and never warned customers.

Ledger chief executive Pascal Gauthier publicly clashed with former Mt. Gox boss Mark Karpeles on X on October 17, 2026, over how early Ledger knew about sophisticated hardware spy implants and how loudly it warned customers, turning a technical dispute over device security into the most visible public falling-out of the industry's biggest hardware-wallet scandal. The argument centered on a single question: could clearer, earlier warnings from Ledger have prevented more than $90 million in user losses tied to tampered devices.

The "no white knight" exchange

Gauthier first defended Ledger's response in a public post, urging Karpeles to stick to known facts and avoid speculation. He then made it personal. "Coming from the Mt Gox CEO... Come on man, you are no white knight. Get real," Gauthier wrote on X, according to Coinotag. The jab referenced the 2014 collapse of Mt. Gox, when roughly 850,000 Bitcoin went missing under Karpeles' leadership. Karpeles answered that his own experience is precisely why he expects higher standards from this industry, and earlier in the exchange had told Gauthier: "I trusted you to do better," AMBCrypto reported.

The March security guide dispute

At the center of the argument is what Ledger knew and when. Karpeles pointed to a security guide on Ledger's own website dated March 6, showing both handmade and mass-produced spy chips, and argued that Ledger understood implants of this sophistication months before the losses mounted. The guide was updated in September, which leaves open when the images actually appeared, Coinotag noted. Karpeles later issued a correction on X: he had initially said Ledger did not talk about the implant situation at all despite knowing about it, then acknowledged that the company did publish an Academy topic in March 2026 that discusses implants and recommends buying devices directly from Ledger or from authorized resellers. In his earlier posts, Karpeles argued that a more visible channel than a blog post was warranted. Ledger asked sellers in seven Asian markets to pause sales, and MediaMarktSaturn halted Ledger sales on October 13 in coordination with the company, according to TokenPost, which also reported that Ledger had not yet examined devices shown online, including a Nano X that Karpeles said was sold through MediaMarkt with a spy implant.

The Genuine Check admission

The most damaging on-record detail is one Ledger does not dispute: its Genuine Check, the process meant to confirm a device ships genuine and unmodified, cannot detect an added implant if the device's original security chip stays intact. Karpeles helped expose the threat himself by opening a sealed Ledger device and finding a hidden circuit board planted inside it. The implant can capture a wallet's 24-word recovery phrase and transmit it to criminals, and that phrase gives attackers full control of every fund the device protects. Ledger has paused sales through the CryptoBilis reseller after investigators identified devices altered to capture wallet recovery phrases remotely. Rival Trezor has also moved to reduce its third-party reseller network.

A $90 million question nobody has verified

Estimates put the damage above $90 million, according to research cited across the saga's coverage, but Ledger has not confirmed a final figure publicly, and Karpeles' claim that earlier warnings could have prevented those losses remains unverified. Karpeles argued that implants built for mass production should have set off alarms. Gauthier said Ledger had done its utmost to protect users and described the security work as difficult.

This article is news reporting and is not investment advice.

Sources

  • Pascal Gauthier, X posts October 17, 2026, primary source: defense of Ledger's response, the "stick to known facts" urging, and the "no white knight" reply to Karpeles
  • Mark Karpeles, X posts October 17, 2026, primary source: "I trusted you to do better," the March 6 security guide claim, the Academy-topic correction, and the sealed-device implant finding
  • TokenPost, October 18, 2026, secondary source: Gauthier's pushback on the earlier-disclosure claim, Ledger's seven-market seller pause, the MediaMarktSaturn October 13 sales halt, Ledger not yet examining devices shown online
  • AMBCrypto, October 17-18, 2026, secondary source: Karpeles' December 2025 warning claim, the March 2026 Academy post, Gauthier reading the criticism as virtue signaling
  • BeInCrypto, October 18, 2026, secondary source: the CEO clash over the $90 million wallet implant scandal
  • Coinotag, October 18, 2026, secondary source: the "no white knight" exchange, the March guide's September update, and the Genuine Check limitation with an intact security chip
Not financial advice. This content is for information and education only. See our disclaimer, editorial policy and disclosures.

MABOnChain Daily Brief

The key crypto and markets stories in one short, plain-language email. Free. Unsubscribe any time.

Loading the signup form…

Prefer chat? Join us on Telegram Watch on YouTube

Keep reading

Scam Alerts

Cysic Attacker Sold 7.2M Minted Tokens and Bridged $727,000 to Ethereum Before the Blacklist

October 19, 2026 · 4 min read

On-chain records reviewed by The Block show the attacker who exploited Cysic's cross-chain bridge on October 17 sold 7.2 million of the 10 million fraudulently minted CYS tokens in 26 transfers within 28 minutes, then bridged the proceeds off BNB Chain and received 306.6 ETH, worth about $727,000, on Ethereum before Cysic blacklisted the recipient address. The remaining 2.8 million CYS was frozen by the blacklist, and the bridge stays closed until a security review ends.

Economy

Trump Waives Russia Tariffs as October 18 Deadline Arrives, Rubio Announces 60-Day Review

October 18, 2026 · 5 min read

President Donald Trump signed an October 16 executive order waiving sanctions and tariffs under the Graham Act days before they were due to take effect, and Secretary of State Marco Rubio said Saturday the president will take up to 60 days to weigh the economic impact. Bitcoin held near $81,600 on Sunday, about 35% below its record, as traders turned to the Federal Reserve's October 28 meeting.

Scam Alerts

Qubic Loses $1.3M as 1,404 Wallets Drained in Seed-Randomness Attack, Network Halted

October 18, 2026 · 4 min read

Qubic halted its network at tick 85,371,949 on October 18, 2026, after an attacker drained 1,404 wallets of 2.94 trillion QU worth about $1.3 million between October 17 and 18. The project says the theft exploited insufficient randomness in wallet seeds generated on older Apple devices and browsers, not the Qubic protocol itself. About 87.1% of the stolen tokens remain immobilized on the paused network, while MEXC froze the 12.9% that reached the exchange.

Markets

Gitcoin (GTC) Jumps 13% to $0.25 as Upbit Listing and Techne Rebrand Momentum Holds

October 18, 2026 · 4 min read

Gitcoin's GTC token climbed about 13% on October 18, 2026, leading Binance's top-volume gainers as momentum from Upbit's October 12 Korean won listing and the protocol's Techne rebrand held into a second week. GTC traded near $0.25 late Sunday after touching an intraday high near $0.29, with roughly $124 million in 24-hour turnover across exchanges, according to market data.

Scam Alerts

Thai Police Arrest Chinese Suspect in Bangkok Over Alleged $75M Laundering Network

October 18, 2026 · 4 min read

Thai immigration police detained 37-year-old Chinese national Wu Chaoshuai at a luxury housing estate in Bangkok's Saphan Sung district on October 16, 2026. Chinese authorities had issued a warrant for him over an alleged transnational crime network that moved more than 500 million yuan through crypto and foreign-currency exchanges across more than 133 accounts. His Thai visa expired more than three years ago; Thailand plans to deport him to China after immigration proceedings.

Scam Alerts

Cysic Halts Cross-Chain Bridge After Attacker Mints 10 Million CYS on BNB Chain

October 18, 2026 · 4 min read

Cysic suspended its cross-chain bridge after an attacker exploited a processing flaw to mint 10 million CYS on BNB Smart Chain on October 17, 2026. Preliminary findings point to unauthorized access to a database supporting the bridge; the recipient address was blacklisted about 76 minutes later with roughly 2.8 million CYS frozen in it. Cysic says no user wallets were touched and the mainnet was unaffected, and that the mint size alone does not establish the dollar loss, which is still under review.

Ethereum

Vitalik Buterin Builds 'Paranoid Mode' AI Agent Setup Using Tor, Cover Traffic and zkAPI

October 18, 2026 · 4 min read

Ethereum co-founder Vitalik Buterin unveiled an experimental 'paranoid mode' for his pi AI agent harness that routes every conversation through a separate Tor circuit, masks requests with random cover traffic, pays for model access through the Ethereum-based zkAPI payment system, and rewrites every prompt locally before it reaches the provider. He says the setup is getting usable but still slow, and warns that Tor is a poor fit against a provider colluding with the network guard, calling instead for a specialized mixnet.

Regulation

Bitget Names Russia, Belarus and Kazakhstan as Prohibited Jurisdictions, Bans 20 Sanctioned Platforms

October 18, 2026 · 4 min read

Bitget's English Terms of Use, updated October 16, 2026, list Russia, Belarus and Kazakhstan among its prohibited jurisdictions, three days after the exchange said it would discontinue services for selected users in a one-off exercise. Separately, the exchange's Greater China arm said it will terminate accounts that transact with 20 sanctioned platforms, including BitPapa and NoOnecrypto, with a permanent no-re-registration rule for violators.

Regulation

Nine Companies, Including Broadcom and Verizon, Formally Object to OKXICE Tokenized Share Trading

October 18, 2026 · 5 min read

Nine U.S.-listed companies, including Broadcom, Verizon, CoreWeave and UnitedHealth, filed formal issuer objections in an October 15, 2026 OKXICE notice, using the SEC's issuer-objection mechanism to keep their shares off the 24/7 tokenized stock venue. Eight of the nine were among the 63 tickers OKXICE named on October 4; the venture says it still plans to launch with dozens of stocks including Nvidia and Apple.

Regulation

EU and 8 Nations Sign Warsaw Protocol to Seize Criminal Crypto Across Borders

October 18, 2026 · 5 min read

The European Union and eight countries signed the Additional Protocol to the Council of Europe's Warsaw Convention in Strasbourg on October 14, 2026, writing crypto-assets explicitly into the international framework for seizing criminal proceeds. The protocol lets authorities confiscate virtual assets urgently without prior notice, gives financial intelligence units power to suspend suspect crypto transactions, requires Asset Recovery and Asset Management Offices in signatory states, and needs five ratifications to enter into force.