Mark Karpelès, former CEO of Mt. Gox, has publicly criticized Ledger's handling of a supply chain compromise involving unauthorized hardware implants in cryptocurrency hardware wallets.
Karpelès stated that Ledger received reports of spy hardware implants as early as December 2025 but responded inadequately, with only a blog post published in March 2026. He contended that earlier and more robust communication could have prevented substantial losses in what became known as the CryptoBillis incident.
The Incident and Scope
In early October, Ledger confirmed that devices sold by reseller CryptoBillis contained unauthorized implants designed to scan and transmit seed phrases to a private server. Losses from the compromise exceeded $90 million. Ledger suspended sales from CryptoBillis and paused distribution in the broader Southeast Asian region.
Karpelès alleged that Ledger downplayed the incident as isolated to CryptoBillis, despite reports of similar implants appearing in other regions. He stated he had assisted several users in checking their devices for compromise. Ledger disputed reports of European exposure after analyzing a reported case in Germany.
Call for Greater Transparency
Karpelès urged Ledger to provide clearer disclosures to end users, noting that without transparent communication, users cannot determine whether their devices have been altered. He expressed that he held Ledger to a higher standard based on lessons from his own experience at Mt. Gox.
Community response largely supported Karpelès' position, with users pressing Ledger for increased transparency regarding the scope and nature of the compromise.
Industry Response
Following the incident, other hardware wallet providers including Trezor and OneKey removed third-party resellers and strengthened their distribution verification processes.
