Nano

French hardware wallet maker Ledger received multiple reports of malicious hardware implants months before its latest security crisis, according to Mark Karpelès, former CEO of the collapsed Bitcoin exchange Mt. Gox.
Karpelès told Cointelegraph he was aware of at least two people who contacted Ledger about tampered devices dating back to December 2025. Karpelès said he hasn’t encountered any public warning Ledger issued in response.
Joe Grand, a security researcher, told Cointelegraph he alerted Ledger on March 4, 2026, about a malicious implant in a Nano X purchased through online marketplace Lazada Thailand in August 2025.
Grand said Ledger acknowledged his findings and said it was investigating internally, but he criticized the company for not proactively warning customers about the threat.<img src="https://s3-images.ctmedia.io/media/content/2026/10/01M52EQZNS5YFWXVZEQKQRNY93/screenshot-2026-10-16-at-92305-am.png" alt="" width="592" height="456">
Vietnamese crypto educator Tai Zen contacted Ledger about a suspected hardware wallet implant in December 2025, according to Mark Karpelès. Source: <a href="https://x.com/Ledger/status/2110416915835338942?s=20" rel="noopener noreferrer nofollow">Tai Zen</a>
Ledger’s ongoing security crisis surfaced Oct. 9, when crypto losses were reported involving wallets sold through CryptoBilis, a reseller authorized in Southeast Asia. Ledger has confirmed that <a href="https://cointelegraph.com/news/ledger-confirms-unauthorized-hardware-implant-losses-may-exceed-86m" rel="noopener noreferrer nofollow">one affected device contained an unauthorized implant</a>.
Ledger declined to comment when asked about its handling of Grand’s disclosure, and <a href="https://x.com/Ledger/status/2110129361382994076" rel="noopener noreferrer nofollow">referred</a> Cointelegraph to its public statements on X.
“Maybe Ledger not responding to a single event of an implant found on a Ledger purchased from a shady dealer is normal,” Karpelès said. He added:&nbsp;
<blockquote>
 However the increasing number of reports they must have received, and the increasing quality/technology used should have alerted them enough to act, and at least remind customers to be careful.”
</blockquote>
<h2 id="marketplace-listings-expose-reseller-verification-gaps">Marketplace listings expose reseller verification gaps</h2>
In a <a href="https://grandideastudio.com/media/ledger_hardware_implant_slides.pdf" rel="noopener noreferrer nofollow">presentation</a> shared with Cointelegraph, Grand identified the seller of the tampered Ledger as “LedgerXXX” on Lazada. At the time of writing, LedgerXXX is not <a href="https://shop.ledger.com/pages/resellers?continent=asia+%26+oceania&amp;country=thailand" rel="noopener noreferrer nofollow">listed</a> as an authorized reseller in Thailand, though Lazada’s Ledger storefront is.
Cointelegraph sought clarification from both Grand and Ledger on the seller’s identity and authorization status when the device was purchased.
OneKey’s head of sales, Archie, told Cointelegraph that marketplaces such as Lazada host numerous independent sellers, making it difficult for customers to distinguish authorized stores from other listings.
<img src="https://s3-images.ctmedia.io/media/content/2026/10/01M52E2G3VDPTSWX5QCSTM2WSC/pasted-image-2848.png" alt="" width="1259" height="437">
Source: Grand Idea Studio (Joe Grand)
Following the recent incidents, OneKey removed its reseller listings pending stricter checks, saying manufacturers must take responsibility for protecting customers rather than relying solely on buyers to identify trustworthy sellers.
<h2 id="unauthorized-wallet-sales-still-raise-security-concerns">Unauthorized wallet sales still raise security concerns</h2>
Grand’s findings were not limited to Ledger. In August 2026, he also alerted Trezor about tampered Trezor One and Model T wallets purchased from unauthorized sellers on TikTok and Facebook.
Trezor told Cointelegraph that counterfeit wallets occasionally appear through unauthorized sellers, as it had <a href="https://blog.trezor.io/stay-safe-shopping-for-hardware-wallets-543f144e3d24" rel="noopener noreferrer nofollow">warned</a> in 2022 about modified devices sold on Russian marketplaces. The company said that its recent claim of no evidence of compromised devices applied only to new wallets sold through authorized resellers.
Related: <a href="https://ct.com/news/trezor-preventative-steps-wallet-tampering-reports" rel="noopener noreferrer nofollow">Trezor reduces resellers as a ‘preventative step’ amid Ledger tampering reports</a>
Still, Trezor said it treats reports involving unauthorized sellers as early warnings and uses researchers’ findings to improve security checks.
“What changes the picture is a new technique, or a first case coming through an authorised channel,” Trezor said. “Either one means the problem has moved closer to ordinary buyers, and that’s when we’d move fastest, including warning customers directly.”
Magazine: <a href="https://ct.com/magazine/scammer-loses-48m-stored-on-tampered-ledgers-asia-express" rel="noopener noreferrer nofollow">Scammer Loses $4.8M Stored On Tampered Ledgers: Asia Express</a>

Ledger’s early implant warnings deserved more action, Karpelès says

Table of Contents

Cointelegraph

Other articles published on Oct 16, 2026

Join our free newsletter for daily crypto updates!