Ledger CEO Pascal Gauthier and former Mt. Gox chief Mark Karpelès have clashed publicly over the company's handling of sophisticated spy implants discovered in its hardware wallets.
Karpelès exposed the threat after opening a sealed Ledger wallet and finding a hidden circuit board capable of capturing a wallet's 24-word recovery phrase and transmitting it to criminals. Such phrases grant attackers full control over stored funds.
Timeline and Warnings Questioned
Karpelès argues that Ledger knew about these advanced implants as early as March, pointing to a security guide published on that date showing both handmade and mass-produced spy chips. The guide was later updated in September, raising questions about when the images first appeared.
He contends that stronger public warnings at the time could have prevented more than $90 million in user losses.
Ledger's Defense and Limitations
Gauthier initially defended Ledger's response, urging Karpelès to verify facts. He then invoked Mt. Gox's 2014 collapse, when approximately 850,000 Bitcoin disappeared under Karpelès' leadership, saying Karpelès was "no white knight."
Karpelès responded that his experience managing that crisis was precisely why he expected higher security standards from hardware wallet makers.
Ledger has acknowledged a critical limitation: its Genuine Check system cannot detect implants if the original security chip remains intact.
Industry Response
Ledger has halted sales through its CryptoBilis reseller, though reports of tampered devices in Europe have widened concerns. Rival hardware wallet maker Trezor has begun reducing its reseller network in response.
The dispute underscores a fundamental vulnerability for investors: even authentic hardware wallets cannot guarantee that a device has not been modified before reaching the customer.
