Former Mt. Gox CEO Mark Karpelès Claims His Ledger Hardware Wallet May Have Spy Module
Former Mt. Gox CEO Mark Karpelès stated that a Ledger hardware wallet he received appears to have a spy module implanted. The device came from Malaysia, and the outer packaging was intact, making it difficult to immediately identify any abnormalities upon opening. He mentioned that the implant is hidden where the screen's original cushioning should be.
In a follow-up explanation, he stated that the module contains LTE communication components, an antenna, an eSIM, and a microcontroller connected to the display bus. According to his description, the module reads the characters displayed on the screen and sends related data after the mnemonic setup is completed. He also noted that this listening feature does not seem abnormal for security components. The post did not disclose the purchase order, device serial number, or independent laboratory verification.
Karpelès advised users to check their devices according to Ledger's official guidelines and provided a support page. He compared it to previous similar packaging, which was rougher and could be identified as non-official without opening. He stated that the intact shrink wrap made it difficult to identify from the outside. These are his public statements, not Ledger's investigation conclusions.
On the same day, Ledger was investigating the financial losses of buyers from Southeast Asian distributor CryptoBilis and requested a halt to sales and shipments. CryptoBilis is listed as an official distributor in Indonesia, Malaysia, and the Philippines. Karpelès only mentioned that the device came from Malaysia and did not specify in the verified post that the seller was CryptoBilis. The company previously stated that tampering has not been confirmed.
Tracking parties estimated the related losses to be nearly $90 million, covering Bitcoin, Ethereum, and TRON. MistTrack reported that Tether is freezing a large amount of USDT in the related addresses. These amounts were not directly linked to Karpelès' post regarding this device.
This is not a transaction but a dispute over the credibility of a hardware device with a named source. The buyer is a user who received the device through Malaysian channels, and the seller is the supply chain that sent the box. The incident was driven by his disassembly post, not the price. The beneficiaries are buyers who have not initialized the device and checked it according to the official page; the pressured parties are users who have completed the mnemonic setup on an unknown source device, as the post did not provide a serial number, and the official confirmation of the implant is still pending.
The intact shrink wrap was described by him as a failure of external inspection. Verification thus falls to official inspection steps rather than the appearance of the packaging.
Source: Public Information
ABAB AI Insight
Mark Karpelès's public identity comes from Mt. Gox. The exchange filed for bankruptcy in 2014 after losing about 850,000 bitcoins, and he was sentenced to probation after being convicted in Japan. Since then, he has spoken multiple times as a technical commentator, not as a Ledger employee or an official verifier in this investigation. On October 9, 2026, he showcased a device from Malaysia with intact shrink wrap, claiming there was an additional module in the cushioning position.
This device has not been publicly linked to any specific theft. Ledger was investigating CryptoBilis on the same day, with sales locations including Malaysia, but Karpelès's post did not mention the order or seller's name. The tracked losses are close to $90 million, accumulated across multiple addresses. Tether can only freeze the related USDT and cannot verify the module inside this hardware. The security components were not described by him as being rewritten; he stated that the display data was read through a bypass.
This can be compared to counterfeit Ledgers that appeared in e-commerce channels in 2018, and phishing after the Ledger customer address leak in 2020. Currently, it is in the personal disassembly phase: the official still states that tampering has not been confirmed, while the post has already provided the Malaysian source and intact shrink wrap. Control lies with the device that has already completed the setup, not with the unopened inventory.
Essentially, the trust anchor shifts from chip specifications to receipt inspection. Manufacturers can guarantee the safety components at the time of leaving the factory but cannot prove that the distribution channel did not add components based on shrink wrap. The mechanism is that intact packaging only proves the outer layer is unbroken, not that the internal cushioning position is still original. Therefore, the official inspection page is more informative than the shrink wrap.
ABAB News · Cognitive Law
Intact shrink wrap only proves the outer layer is unbroken.
Personal disassembly can provide hints but cannot replace confirmation.
Security components not reporting errors do not mean the screen is free from bypass.