Former Mt. Gox CEO Mark Karpelès stated that a Ledger hardware wallet he received appears to have a spy module implanted. The device came from Malaysia, and the outer packaging was intact, making it difficult to immediately identify any abnormalities upon opening. He mentioned that the implant is hidden where the screen's original cushioning should be.

In a follow-up explanation, he stated that the module contains LTE communication components, an antenna, an eSIM, and a microcontroller connected to the display bus. According to his description, the module reads the characters displayed on the screen and sends related data after the mnemonic setup is completed. He also noted that this listening feature does not seem abnormal for security components. The post did not disclose the purchase order, device serial number, or independent laboratory verification.

Karpelès advised users to check their devices according to Ledger's official guidelines and provided a support page. He compared it to previous similar packaging, which was rougher and could be identified as non-official without opening. He stated that the intact shrink wrap made it difficult to identify from the outside. These are his public statements, not Ledger's investigation conclusions.

On the same day, Ledger was investigating the financial losses of buyers from Southeast Asian distributor CryptoBilis and requested a halt to sales and shipments. CryptoBilis is listed as an official distributor in Indonesia, Malaysia, and the Philippines. Karpelès only mentioned that the device came from Malaysia and did not specify in the verified post that the seller was CryptoBilis. The company previously stated that tampering has not been confirmed.

Tracking parties estimated the related losses to be nearly $90 million, covering Bitcoin, Ethereum, and TRON. MistTrack reported that Tether is freezing a large amount of USDT in the related addresses. These amounts were not directly linked to Karpelès' post regarding this device.

This is not a transaction but a dispute over the credibility of a hardware device with a named source. The buyer is a user who received the device through Malaysian channels, and the seller is the supply chain that sent the box. The incident was driven by his disassembly post, not the price. The beneficiaries are buyers who have not initialized the device and checked it according to the official page; the pressured parties are users who have completed the mnemonic setup on an unknown source device, as the post did not provide a serial number, and the official confirmation of the implant is still pending.

The intact shrink wrap was described by him as a failure of external inspection. Verification thus falls to official inspection steps rather than the appearance of the packaging.

Source: Public Information