Former Mt. Gox CEO Mark Karpelès says Ledger received multiple reports of malicious hardware wallet implants months before its latest security crisis, with at least two cases going back to December 2025, but he saw no public warning from the company. According to Cointelegraph reporting, Karpelès told the outlet he was aware of at least two people who contacted Ledger about tampered devices starting in December 2025.
The disclosure adds another layer to a wallet security story that has already produced major losses. In a separate BTC-Pulse report, Chainalysis: Task Scammer Loses Over 60 BTC Worth $4.8M in Ledger Wallet Theft detailed how attackers can exploit compromised signing through Ledger devices, showing why early alerts about tampering are critical for bitcoin users.
What Ledger reportedly knew before October
Cointelegraph’s reporting identifies security researcher Joe Grand, who alerted Ledger on March 4, 2026 about a malicious implant in a Nano X purchased through Lazada Thailand in August 2025. Grand said Ledger acknowledged his findings and said it was investigating internally, but he criticized the company for not proactively warning customers. Vietnamese crypto educator Tai Zen contacted Ledger about a suspected implant in December 2025, according to Karpelès. The disclosure pattern is notable because Karpelès has spent years working on exchange and wallet security since the Mt. Gox collapse and is not a casual critic of custody products.
The public crisis surfaced on October 9 when crypto losses were reported involving wallets sold through CryptoBilis, an authorized reseller in Southeast Asia. Ledger has confirmed that one affected device contained an unauthorized implant. The company declined to comment on its handling of Grand’s disclosure and referred reporters to its public statements on X.
The timeline underscores a wider bitcoin custody challenge. Even as mining and treasury operations expand, as shown by Canaan Reports 44 BTC Mined in September, Treasury Hits 1,875 BTC, self-custody hardware remains only as secure as the supply chain that delivers it.
Why a delayed warning should worry wallet users
For bitcoin self-custody, the gap between private disclosure and public notice can be just as serious as the implant itself. Buyers may continue using compromised devices, and unsold tampered units can remain in circulation. Karpelès’s claim that no public warning followed the early reports suggests a communication failure even if Ledger was investigating internally.
The incident arrives during a period when bitcoin infrastructure is expanding across mining, treasury, and custody. CleanSpark Reports 529 BTC in September Operational Update illustrates the scale of bitcoin holdings that depend on secure storage, but the Ledger case shows that hardware-level security still depends on rapid vendor communication, careful reseller checks, and user attention to supply-chain risks.
