Ledger was warned months before its latest hardware-wallet security crisis that some devices may have been modified with malicious implants, according to former Mt. Gox CEO Mark Karpelès. The disclosures raise questions about how quickly the French wallet maker responded and how effectively customers can verify sellers on online marketplaces.
Karpelès told Cointelegraph that he knew of at least two people who had contacted Ledger about suspected tampered devices as early as December 2025. He said he had not seen a public warning from Ledger addressing those reports.
The issue became public after crypto losses were reported on Oct. 9 involving wallets sold through CryptoBilis, an authorized Ledger reseller in Southeast Asia. Ledger has confirmed that one affected device contained an unauthorized implant. A hardware-wallet implant is an alteration made to a device that can compromise its security or change how it operates before it reaches the customer.
The reported cases involve products bought through channels that customers may assume are legitimate, but where the status of individual sellers can be difficult to establish. That distinction is central to the dispute: a device may carry a recognizable brand while having been sold or altered outside the manufacturer’s authorized distribution network.
Researchers say warnings came before latest crisis
Security researcher Joe Grand said he notified Ledger on March 4, 2026, after finding a malicious implant in a Nano X purchased through Lazada Thailand in August 2025. Grand said Ledger acknowledged his findings and told him it was investigating internally.
Grand nevertheless criticized the company for not warning customers proactively about the threat. Ledger declined to comment specifically on its handling of his disclosure and referred Cointelegraph to its public statements on X.
Karpelès argued that the number and sophistication of the reports should have prompted a broader response. He said that while failing to respond publicly to one suspected device from a questionable seller might be understandable, multiple reports and increasingly advanced techniques should have led Ledger to take action and remind customers to exercise caution.
Karpelès also said Vietnamese crypto educator Tai Zen contacted Ledger over a suspected implant in December 2025. The reported timeline means concerns about modified devices were circulating before the losses linked to CryptoBilis were reported in October 2026.
The material does not establish how many devices were affected overall or whether the earlier reports and the CryptoBilis-related losses involved the same technique. Ledger has confirmed an unauthorized implant in one affected device, but has not provided, in the supplied material, a broader total for compromised wallets.
Online marketplaces create seller-verification gaps
Grand’s presentation identified the seller of the tampered Nano X as “LedgerXXX” on Lazada. At the time of the reporting, that seller was not listed as an authorized Ledger reseller in Thailand, although Lazada’s Ledger storefront was listed as authorized. Cointelegraph sought clarification from Grand and Ledger about the seller’s identity and authorization status when the wallet was purchased.
The case highlights the difference between an official brand storefront and individual marketplace listings. OneKey sales chief Archie said platforms such as Lazada host many independent sellers, making it difficult for buyers to distinguish authorized outlets from unrelated listings.
OneKey responded to the incidents by removing its reseller listings while it introduced stricter checks. The company said manufacturers must take responsibility for protecting customers rather than relying entirely on buyers to identify trustworthy sellers.
For hardware-wallet users, the distribution chain matters because the security of a device can be undermined before it is activated. The reports also show why marketplace verification has become part of the wider security discussion, alongside the design and software of the wallet itself.
Trezor reports similar concerns involving unauthorized sellers
The concerns are not limited to Ledger. Grand said he alerted Trezor in August 2026 after finding tampered Trezor One and Model T wallets purchased from unauthorized sellers on TikTok and Facebook.
Trezor said counterfeit wallets sometimes appear through unauthorized sellers and noted that it had warned in 2022 about modified devices sold on Russian marketplaces. The company clarified that its recent statement saying it had no evidence of compromised devices applied only to new wallets sold through authorized resellers.
Trezor said it treats reports involving unauthorized sellers as early warnings and uses researchers’ findings to improve its security checks. It added that the situation would change if a new technique appeared or if a first case came through an authorized channel, because that would indicate the problem had moved closer to ordinary buyers and would prompt faster action, including direct customer warnings.
The competing responses underline the main issue raised by the Ledger reports: whether manufacturers should wait for evidence involving authorized distribution, or issue broader warnings when credible reports emerge from unauthorized marketplace sellers. The supplied reporting does not resolve that question, but it documents growing scrutiny of reseller controls across the hardware-wallet industry.
Moneyiar market picture
Moneyiar data at 2026-10-17 21:43:00 +03:30 showed all four tracked assets below their 24-hour prices, although Walrus remained higher over seven days:
- Monad (MON): $0.0214784939, down 6.09% in 24 hours and 14.95% over seven days.
- edgeX (EDGE): $0.2938452282, down 3.14% in 24 hours and 18.39% over seven days.
- Four (FORM): $0.2494703637, down 2.93% in 24 hours and 10.59% over seven days.
- Walrus (WAL): $0.0401854272, down 11.29% in 24 hours but up 10.62% over seven days.
