Galaxy

Secure

Clash

<h2 id="span-style-font-weight-400-tldr-span">TLDR:</h2>
<ul>
 <li style="font-weight: 400">Ledger wallet theft estimates vary: Galaxy Research counted 91 million dollars across five networks, while trackers including BNB Chain put the total at 93 million to 95 million dollars; Ledger has not confirmed its own figure.</li>
 <li style="font-weight: 400">Karpelès cited Ledger’s March guide, but the current page lists a September update and does not reveal when specific warnings or tampering images were added.</li>
 <li style="font-weight: 400">Ledger’s Genuine Check verifies the Secure Element, yet its documentation says it may not detect added hardware if the original security chip remains intact.</li>
 <li style="font-weight: 400">On October 9, Ledger asked CryptoBilis to pause sales and shipments. It told recent buyers not to initialize unused wallets and advised those who had set them up to transfer assets to a wallet with a fresh recovery phrase.</li>
</ul>
The Ledger wallet theft dispute escalated publicly on October 17. Ledger CEO Pascal Gauthier challenged former<a href="https://parameter.io/revolut-faces-780m-bitcoin-extortion-following-major-customer-data-compromise/" rel="noopener noreferrer nofollow"> Mt. Gox chief Mark Karpelès</a> over warnings about modified hardware wallets. The exchange followed reports of losses involving devices sold through CryptoBilis, a Southeast Asian reseller. Investigators found unauthorized electronics inside at least one device, reportedly designed to capture recovery phrases during setup.&nbsp;
Karpelès said Ledger had discussed tampering in a March security guide, but questioned whether customers received a clear warning. Gauthier defended the company’s work and urged him to distinguish evidence from speculation. That puts<a href="https://blockonomi.com/ledger-faces-backlash-over-hardware-wallet-implant-warnings/" rel="noopener noreferrer nofollow"> Ledger wallet</a> theft estimates and warnings under scrutiny.&nbsp;
<h2 id="b-ledger-wallet-theft-dispute-puts-earlier-warnings-under-scrutiny-b">Ledger Wallet Theft Dispute Puts Earlier Warnings Under Scrutiny</h2>
Karpelès corrected his earlier claim that Ledger had never discussed physical implants. He cited “Best Practices To Securely Buy Your Ledger Signer”, first published March 6, 2026. Ledger lists September 18 as its<a href="https://moneycheck.com/xrp-ledger-version-3-4-1-addresses-critical-security-issues-ahead-of-october-batch-activation/" rel="noopener noreferrer nofollow"> latest update</a>.&nbsp;
<div class="embed-x">
 <blockquote class="twitter-tweet">
 Correction: I said <a href="https://x.com/Ledger?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@Ledger</a> didn't talk about the implant situation at all despite knowing about it – they did publish an academy topic in March 2026 that talks about it and recommends buying direct or from Authorized Resellers.<a href="https://t.co/UUNH1H2L3D" rel="noopener noreferrer nofollow">https://t.co/UUNH1H2L3D</a><a href="https://t.co/UNrxyLnsmd" rel="noopener noreferrer nofollow">pic.twitter.com/UNrxyLnsmd</a>
 — Mark Karpelès (@MagicalTux) <a href="https://x.com/MagicalTux/status/2111398487762026950?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">October 17, 2026</a>
 </blockquote>
</div>
The guide covers counterfeit wallets, preset recovery phrases, and genuine devices modified after leaving the factory. It says added components may collect information shown during setup. The current page includes images of altered circuit boards.&nbsp;
Karpelès argued the examples showed Ledger knew about sophisticated implants before customers reported CryptoBilis devices. He said a prominent warning could have prevented losses above 90 million dollars, but that claim remains unproven.
Because Ledger updated the page in September, it does not show when each image or warning appeared. The current record alone cannot establish what Ledger knew about specific CryptoBilis devices in March.&nbsp;
Mt. Gox collapsed in 2014 after major <a href="https://coincentral.com/bitcoin-price-prediction-2027-can-btc-reach-150000-next-year/" rel="noopener noreferrer nofollow">Bitcoin </a>losses, leaving creditors in a long recovery process. Gauthier invoked that failure; Karpelès said it shaped his security expectations. Their exchange yielded no new evidence about who modified devices or when.
<h2 id="b-cryptobilis-investigation-shows-the-limits-of-device-authentication-b">CryptoBilis Investigation Shows the Limits of Device Authentication</h2>
Ledger’s Genuine Check verifies the Secure Element, a chip that handles sensitive wallet operations. During setup, official software requests a response signed with the chip’s manufacturing identity.
It confirms the chip is authentic, but cannot inspect every component. Ledger says added hardware may go undetected when the original chip remains intact.&nbsp;
That limitation matters in the Ledger wallet theft investigation. Investigators reportedly found an implant near a CryptoBilis device screen. It could capture the 24-word phrase shown during setup while leaving the original chip and security functions in place.
Anyone with a complete recovery phrase may access associated funds without the original device. The implant reportedly sent captured words through a cellular connection.&nbsp;
Ledger said the discovery did not show compromise of its chip, operating system, or transaction signing. The Ledger wallet theft case involved physical interference during distribution, exposing a gap between chip authentication and device integrity.&nbsp;
Ledger opened an investigation after customer complaints. On October 9, it asked CryptoBilis to pause sales and shipments. Ledger told customers who bought devices in the prior 90 days not to initialize unused wallets. Ledger advised customers who had initialized devices to move assets to a new wallet with a fresh recovery phrase.&nbsp;
Galaxy Research’s<a href="https://www.galaxy.com/insights/research/ledger-cryptobilis-wallet-implant-theft?utm" rel="noopener noreferrer nofollow"> Ledger wallet theft estimate</a> was 91 million dollars across five networks on October 16. Trackers that included BNB Chain put the figure at 93 million to 95 million. Ledger has not confirmed its total. The gap likely reflects scope. Neither the on-chain counts nor the guide establishes how much a warning could have prevented.&nbsp;
Ledger’s guidance says authorized sales and a passing check cannot prove nobody physically modified a wallet. Buyers should inspect devices and complete authentication through official software before setup begins.&nbsp;
Ledger advises buyers to purchase directly from the company or its authorized sellers. Authorized resellers cannot return devices to inventory for resale. A tampered wallet report in Germany prompted retailers to review distribution practices as the broader inquiry continues.
The post <a href="https://blockonomi.com/ledger-ceo-and-mt-gox-boss-clash-over-wallet-theft-warnings/" rel="noopener noreferrer nofollow">Ledger CEO and Mt. Gox Boss Clash Over Wallet Theft Warnings</a> appeared first on <a href="https://blockonomi.com" rel="noopener noreferrer nofollow">Blockonomi</a>.

Ledger CEO and Mt. Gox Boss Clash Over Wallet Theft Warnings

Table of Contents

Blockonomi

Other articles published on Oct 18, 2026

Solana Rapidly Closes The RWA Gap With Ethereum

Lesser-known memecoin ecosystems you should be watching...

TIA and INJ lead gains for the week.

MemeCore x LayerZero x Stargate

Meteora is making SERIOUS money.

Most Americans polled oppose betting on elections: Reuters

Join our free newsletter for daily crypto updates!