Ledger Faces Questions Over Months-Old Implant Reports as Karpelès Cites More Resellers

Mark Karpelès says Ledger was told about tampered hardware wallets as early as December 2025, while The Defiant reports he now points to two more resellers. Ledger says its German stock checks turned up no tampering, and it has not confirmed a loss connected to a device purchased outside Southeast Asia.

Ledger's tampering crisis widens beyond one reseller

Ledger, the French hardware wallet maker, is under growing scrutiny over how it handled early reports of tampered devices. Cointelegraph reported on Oct. 16 that former Mt. Gox CEO Mark Karpelès says the company was contacted about malicious hardware implants months before its current security crisis became public.

The Defiant published a separate report the same day. Its headline says Karpelès reports implants in devices from two more resellers, and its summary gives Ledger's answer. According to The Defiant, Ledger says inspections of its stock in Germany found no tampering. The company also says it has not verified a drain linked to a device bought outside Southeast Asia.

What Karpelès and the researchers say they told Ledger

Karpelès told Cointelegraph that two or more people had approached Ledger over altered devices, with the earliest contact going back to December 2025. He said he had not seen any public warning from Ledger in response. One of them, Vietnamese crypto educator Tai Zen, reportedly raised a suspected implant that month.

Security researcher Joe Grand gave a more specific account. He said he notified Ledger on March 4, 2026, of a malicious implant found in a Nano X that he had bought through Lazada Thailand in August 2025. Grand said Ledger acknowledged the findings and said it was investigating internally. He criticized the company for not warning customers proactively.

Ledger declined to comment on how it handled Grand's disclosure. It referred Cointelegraph to its public statements on X.

Key dates and claims at a glance

The timeline reported by Cointelegraph runs from Grand's purchase in August 2025 to the reports published in October 2026.

• December 2025: Karpelès says at least two people contacted Ledger about tampered devices, including Tai Zen.
• August 2025: Grand bought the Nano X in question through Lazada Thailand from a seller he named in a presentation.
• March 4, 2026: Grand says he notified Ledger, which told him it was looking into the matter internally.
• August 2026: Grand says he alerted Trezor about tampered Trezor One and Model T wallets bought from unauthorized sellers on TikTok and Facebook.
• Oct. 9, 2026: Losses tied to wallets from CryptoBilis, an authorized reseller in Southeast Asia, came to light.
• Oct. 16, 2026: The Defiant and Cointelegraph publish their reports.

Where the two outlets' accounts agree and where they differ

Both outlets center on Karpelès and on Ledger's handling of implant reports. Cointelegraph supplies the history, the named researchers and the reseller details. The Defiant's available text is limited to a headline and a short summary. It adds Ledger's stated position on German stock inspections and on an unverified drain, but nothing beyond that.

The accounts are not in direct conflict, but they emphasize different things. Karpelès's claims, as Cointelegraph presents them, stress that earlier warnings went unanswered in public. Ledger's position, as The Defiant summarizes it, is that its own checks have not found tampering in the stock it inspected. Neither summary establishes that the two additional resellers named in The Defiant's headline were the source of any specific loss.

The summary also says Ledger's authenticity check cannot detect the added hardware. Taken literally, that means a device could pass the check while still containing an implant.

Why the seller channel is the weak point

Cointelegraph reports that Ledger acknowledged an unauthorized implant in one affected device. Grand's presentation named a Lazada seller; according to Cointelegraph, that seller currently lacks authorized-reseller status in Thailand, unlike Lazada's own Ledger storefront. Cointelegraph asked both Grand and Ledger about the seller's status when the device was bought and had not reported an answer.

OneKey's head of sales, Archie, told Cointelegraph that marketplaces host many independent sellers, which makes authorized stores hard to tell apart from other listings. OneKey has removed its reseller listings pending stricter checks. It argues that manufacturers, not buyers alone, should carry responsibility for customer protection.

Trezor told Cointelegraph that counterfeit wallets occasionally surface through unauthorized sellers and that it warned about modified devices on Russian marketplaces in 2022. It said its earlier statement that it had seen no evidence of compromised devices applied solely to new units sold via authorized resellers. The company added: "What changes the picture is a new technique, or a first case coming through an authorised channel."

What holders and project teams can check

A hardware wallet protects keys only if the device is genuine and unmodified when it arrives. An implant added before sale can undermine that protection even when the software-side authenticity check passes, which is the limitation The Defiant's summary describes. Buying directly from a manufacturer or a clearly authorized reseller reduces exposure, and the reported cases involved marketplace or unauthorized sellers, apart from the CryptoBilis losses.

Teams that hold treasury funds on hardware wallets can review where their devices were purchased and who handled them. The reports so far are about individual devices and sellers, not a confirmed flaw in every unit.

Open questions to watch

Several points remain unresolved in the reporting. It is not clear whether Ledger will publish a customer warning or change its verification process. The identity and status of the two additional resellers is not detailed in the text available from The Defiant. Ledger also says it has not confirmed a loss connected to a device purchased outside Southeast Asia.

Trezor's statement leaves another question open. It says it would warn customers directly if an implant case came through an authorized channel, so any such confirmed case would mark a shift in the debate.

Market snapshot

Asset	Price	24h	7d	Market cap
Bitcoin (BTC)	$81,624	+0.2%	-1.6%	$1.64 trillion

CoinGecko data as of 2026-10-18 (UTC).

FAQ

What did Mark Karpelès say about Ledger?

Karpelès told Cointelegraph that two or more people approached Ledger over altered devices, with contact beginning in December 2025. He said he had seen no public warning from Ledger in response.

How does Ledger respond to the tampering reports?

According to The Defiant, Ledger says inspections of its stock in Germany found no tampering. It also says it has not yet confirmed a loss connected to a device purchased outside Southeast Asia. Cointelegraph separately reports that Ledger acknowledged an unauthorized implant in one affected device.

Which wallet makers are involved besides Ledger?

Joe Grand told Cointelegraph he alerted Trezor in August 2026 about tampered Trezor One and Model T wallets bought from unauthorized sellers. OneKey removed its reseller listings pending stricter checks.

Sources

• The Defiant: Karpelès Reports Ledger Implants in Devices From Two More Resellers (2026-10-16)
• Cointelegraph: Ledger’s early implant warnings deserved more action, Karpelès says (2026-10-16)
• CoinGecko (market data)