Former Mt. Gox CEO: At least two people reported device tampering to Ledger as early as December 2025
According to Cointelegraph, former Mt. Gox CEO Mark Karpelès stated that at least two individuals reported device tampering to Ledger as early as December 2025.
Security researcher Joe Grand also reported a malicious hardware implant in a Nano X to Ledger on March 4, 2026; the device was purchased in August 2025 through Thailand's Lazada. Ledger confirmed the discovery and stated that an internal investigation is underway.
Both individuals questioned why Ledger did not timely issue warnings to customers.
Ledger declined to comment further on the handling of Grand's report and directed media to its public statements on the X platform.
Karpelès noted that he had not seen any public warnings from Ledger regarding these early reports; Grand's report involved an implant that intercepted screen data to extract recovery phrases and transmitted them via cellular networks.
Recently, Ledger confirmed that some devices sold by its Southeast Asian authorized distributor CryptoBilis contained unauthorized hardware implants and suspended related sales; the company stated that checks of German retail inventory found no tampering and has not verified financial losses related to devices purchased outside Southeast Asia.
The implant can bypass Genuine Check, as the security component remains intact, and can only be discovered by opening or disassembling the device.
Source: Public information
ABAB AI Insight
Mark Karpelès was the CEO of Mt. Gox and was convicted after the exchange's collapse in 2014 (data falsification, acquitted of embezzlement, suspended sentence). He later engaged in security research and dismantled multiple generations of Ledger Nano X implants through Tibane Labs; Joe Grand is a hardware security researcher who publicly shared early reverse engineering results of the implants at hardwear.io in May 2026 and provided details of his March 4 report to the media.
Ledger initiated an internal investigation upon receiving Grand's report but did not issue a customer warning; after the CryptoBilis incident became public in October 2026, the company confirmed that one affected device contained an implant and stated that checks of German inventory found no anomalies, while limiting the explanation of Genuine Check to its inability to detect additional circuits.
This is similar to the delayed responses from manufacturers to reports from third-party channels in supply chain attacks (such as other hardware wallets or consumer electronics supply chain events), or the community's questioning of the timeliness of information disclosure following early exchange security incidents; currently, Ledger is expanding from authorized distributor sales to multiple markets while facing the transition of implants from prototype to mass production.
Essentially, this reflects a restructuring of the industry chain: the trust anchor of hardware wallets is shifting from the device itself to supply chain and distributor verification, with implants intercepting data paths from the security component to the screen to steal recovery phrases without damaging the security component, rendering Genuine Check ineffective; early reports not converted into public warnings have turned distribution channels into attack surfaces, forcing manufacturers and researchers to jointly define detection and migration standards.
ABAB News · Cognitive Laws
- Early reports not made public = subsequent losses expand
- Intact security component ≠ device not tampered
- Supply chain is harder to verify than firmware.