Karpelès: Ledger's Early Implant Warnings Needed Faster Action

(MENAFN- Crypto Breaking) French hardware wallet vendor Ledger disclosed that some customer losses tied to wallets sold through a Southeast Asia reseller involved devices containing an unauthorized hardware implant. The episode has reignited scrutiny of how tampered units reach end users-and whether manufacturers act quickly enough after receiving early warning signs.

According to Mark Karpelès, former CEO of Mt. Gox, he was told of tampered Ledger devices months before Ledger's latest security crisis surfaced. Separately, security researcher Joe Grand says he reported a malicious implant to Ledger as early as March 4, 2026-based on a Nano X purchased from online marketplace Lazada Thailand in August 2025.

Key takeaways

Ledger confirmed that at least one affected device contained an unauthorized implant tied to recent loss reports involving wallets sold via a Southeast Asia reseller. Mark Karpelès says he had received reports of tampered Ledger hardware dating back to December 2025, before the Oct. 9 crisis emerged. Joe Grand claims he alerted Ledger on March 4, 2026 about a malicious implant in a Nano X bought on Lazada Thailand in August 2025. Grand criticized Ledger for not proactively warning customers despite earlier reports, while Ledger did not comment on its handling of the disclosures. The broader pattern-researchers also reporting tampered wallets from unauthorized marketplace sellers-highlights persistent gaps in reseller verification across e-commerce platforms.

Early warnings surfaced before Ledger's latest crisis

Ledger's ongoing security troubles became public on Oct. 9, when reports of crypto losses involved wallets that had been sold through CryptoBilis, an authorized reseller in Southeast Asia. Ledger later confirmed that one of the affected devices contained an unauthorized implant, as detailed in Cointelegraph reporting: Ledger confirms unauthorized hardware implant losses may exceed $86M.

Karpelès told Cointelegraph that he was aware of at least two instances in which people contacted Ledger about tampered devices dating back to December 2025. He also said he had not seen any public warning from Ledger responding to those earlier reports.

Cointelegraph also reports a security researcher's direct outreach. Joe Grand said he alerted Ledger on March 4, 2026 about a malicious implant in a Ledger Nano X purchased through Lazada Thailand in August 2025. Grand said Ledger acknowledged the findings and stated it was investigating internally. However, he argued that Ledger should have done more proactively-particularly by warning customers-given what he characterizes as recurring evidence.

When asked about Ledger's handling of Grand's disclosure, Ledger declined to comment. Cointelegraph reports Ledger redirected the inquiry to its public statements on X.

Marketplace listings reveal how tampered devices can bypass official channels

Grand's analysis, shared with Cointelegraph via a presentation, points to the marketplace path of the compromised device. He identified the seller listing for the tampered Ledger as“LedgerXXX” on Lazada, using the time of the August 2025 purchase as the reference point.

At the time of publication, Cointelegraph reports that LedgerXXX was not listed as an authorized reseller in Thailand on Ledger's official reseller page. By contrast, Lazada's Ledger storefront was listed.

Cointelegraph sought clarification from both Grand and Ledger about how the seller was identified at the time of purchase and whether authorization status aligned with the marketplace listing.

OneKey's head of sales, Archie, told Cointelegraph that large marketplaces host many independent sellers. That ecosystem, he said, makes it hard for buyers to reliably distinguish authorized stores from third-party listings-especially when marketplace interfaces aggregate sellers under broad product pages.

Following the recent incidents, OneKey reportedly removed its own reseller listings and said it would carry out stricter checks. The company's position, as described by Cointelegraph, is that device manufacturers should take responsibility for safeguarding customers rather than leaving verification to buyers.

Security risk doesn't stop at one brand or one region

Grand's disclosures are described as not limited to Ledger. In August 2026, he also reported tampered Trezor devices-specifically Trezor One and Model T wallets-purchased from unauthorized sellers on TikTok and Facebook.

Cointelegraph says Trezor told the outlet that counterfeit wallets can appear via unauthorized sellers. Trezor also referenced earlier guidance from 2022 warning about modified devices sold on Russian marketplaces. Importantly, the company said its recent claim of no evidence of compromised devices applied only to new wallets sold through authorized resellers, not to units acquired through unverified channels.

Cointelegraph previously covered the broader theme of how vendors respond to these reports, including a related story on Trezor's steps amid tampering reports. Trezor also said it treats reports from unauthorized sellers as early warning signals and uses researchers' findings to strengthen security checks.

That framing matters because it highlights an asymmetry in how risk escalates: many marketplace tampering reports originate outside official distribution networks, but any evidence that a compromised unit passes through authorized channels would suggest a different level of threat-and a different urgency in public communication.

What investors and users should watch next

This latest round of reporting underscores a practical security issue for hardware wallet users: buying from marketplaces can introduce verification gaps even when official storefronts exist nearby. Readers should watch for clearer, faster manufacturer communication after researcher disclosures, along with any updates that clarify whether compromised devices can be traced to unauthorized sellers, authorized supply chains, or both.

Risk & affiliate notice: Crypto assets are volatile and capital is at risk. This article may contain affiliate links.

MENAFN16102026008006017065ID1111822200