Ledger’s Early Hardware Wallet Implant Reports Draw Scrutiny
Ecosystem
English
News
Markets
Features
Research
Opinion
Podcasts
Newsletters
Commissioned
About
- DOGE: $0.08061 (2.22%)
- TRX: $0.3354 (0.43%)
- LINK: $12.25 (2.13%)
- ZEC: $1,164.06 (5.23%)
- ADA: $0.2240 (2.85%)
- XRP: $1.30 (2.35%)
- ETH: $2,432.52 (0.56%)
- BTC: $81,573.93 (0.62%)
- XMR: $559.62 (0.06%)
- BNB: $721.95 (1.15%)
- XLM: $0.1795 (1.97%)
- SOL: $104.89 (1.23%)
- HYPE: $79.85 (1.64%)
Written by:
- Helen Partz, staff writer
- Yohan Yun, staff editor
Ledger’s early implant warnings deserved more action, Karpelès says
Latest News
Published: October 16, 2026
Ledger, the French hardware wallet maker, faced scrutiny over its handling of reports regarding tampered hardware wallets months before its recent security crisis. According to Mark Karpelès, the former CEO of Mt. Gox, Ledger was contacted about these risks as early as December 2025.
Karpelès stated he was aware of at least two individuals who reached out to Ledger regarding suspicious devices, but he noted a lack of public warnings from the company.
Joe Grand, a security researcher, revealed to Cointelegraph in March 2026 that he informed Ledger about a malicious implant in a Nano X purchased from Lazada Thailand in August 2025. Grand criticized Ledger's response, arguing they should have proactively warned customers.
Another incident involved Vietnamese crypto educator Tai Zen, who contacted Ledger about a suspected implant in December 2025, as reported by Karpelès.
Ledger's security crisis gained attention on October 9, 2026, when crypto losses linked to wallets sold through CryptoBilis, a reseller authorized in Southeast Asia, were reported. Ledger confirmed one affected device contained an unauthorized implant.
When asked about their handling of Grand’s disclosure, Ledger declined to comment, referring Cointelegraph to their public statements.
Karpelès expressed his concern:
"Maybe Ledger not responding to a single event of an implant found on a Ledger purchased from a shady dealer is normal. However, the increasing number of reports they must have received, and the increasing quality/technology used should have alerted them enough to act, and at least remind customers to be careful."
Marketplace listings expose reseller verification gaps
Grand's investigation, shared with Cointelegraph, revealed the seller of the tampered Ledger as "LedgerXXX" on Lazada. At the time of writing, LedgerXXX is not listed as an authorized reseller in Thailand, despite Lazada's authorized Ledger storefront.
Archie, Head of Sales at OneKey, acknowledged the difficulty customers face in distinguishing authorized stores from others on marketplaces like Lazada. OneKey temporarily removed its reseller listings pending stricter checks, emphasizing the need for manufacturers to protect customers rather than relying solely on buyers.
Unauthorized wallet sales still raise security concerns
Grand's findings weren't limited to Ledger. In August 2026, he also alerted Trezor about modified Trezor One and Model T wallets purchased from unauthorized sellers on TikTok and Facebook. Trezor confirmed counterfeit wallets occasionally appear through unauthorized sellers, as they had previously warned in 2022.