French hardware wallet maker Ledger received multiple reports of malicious hardware implants months before its recent security crisis, according to Mark Karpelès, former CEO of the collapsed Bitcoin exchange Mt. Gox.
Karpelès told Cointelegraph he was aware of at least two people who contacted Ledger about tampered devices dating back to December 2025. He said he has not encountered any public warning Ledger issued in response to these reports.
Early Security Researcher Alerts
Security researcher Joe Grand alerted Ledger on March 4, 2026, about a malicious implant found in a Nano X purchased through online marketplace Lazada Thailand in August 2025. Grand said Ledger acknowledged his findings and stated it was investigating internally, but he criticized the company for not proactively warning customers about the threat.
Vietnamese crypto educator Tai Zen also contacted Ledger about a suspected hardware wallet implant in December 2025, according to Karpelès.
Public Crisis and Response
Ledger's security crisis became public on October 9 when crypto losses were reported involving wallets sold through CryptoBilis, a reseller authorized in Southeast Asia. Ledger confirmed that one affected device contained an unauthorized implant.
When asked about its handling of Grand's disclosure, Ledger declined to comment and referred Cointelegraph to its public statements on social media.
Concerns Over Reseller Verification
In a presentation shared with Cointelegraph, Grand identified the seller of the tampered Ledger as "LedgerXXX" on Lazada. At the time of writing, LedgerXXX was not listed as an authorized reseller in Thailand, though Lazada's official Ledger storefront is.
Archie, head of sales at OneKey, told Cointelegraph that marketplaces such as Lazada host numerous independent sellers, making it difficult for customers to distinguish authorized stores from other listings. Following recent incidents, OneKey removed its reseller listings pending stricter verification checks.
Broader Supply Chain Issues
Grand's findings extended beyond Ledger. In August 2026, he also alerted Trezor about tampered Trezor One and Model T wallets purchased from unauthorized sellers on TikTok and Facebook.
Trezor told Cointelegraph that counterfeit wallets occasionally appear through unauthorized sellers, noting it had warned in 2022 about modified devices sold on Russian marketplaces. The company said its recent claim of no evidence of compromised devices applied only to new wallets sold through authorized resellers.
Trezor stated it treats reports involving unauthorized sellers as early warnings and uses researchers' findings to improve security checks.
