Ledger is under scrutiny after hackers secretly changed authentic hardware wallets offered by Southeast Asian reseller CryptoBilis, adding hidden components that may record users' 24-word recovery password and send it through LTE.

Ledger CEO Pascal Gauthier and former Mt. Gox CEO Mark Karpelès are openly at war about how the company handled previous warnings as a result of the finding. Karpelès is creating an open-source detector to assist in identifying potentially corrupted wallets while Ledger looks into impacted devices and stops reseller sales.

How Spy Implants Captured Ledger Wallet Recovery Phrases

Genuine Ledger hardware wallets that were physically changed before being sent to customers were used in the attack. After unlocking the devices and installing hidden electronic components, the attackers sent them back to distribution through CryptoBilis, a Southeast Asian reseller.

The recovery phrase shown during the first wallet setup was the target of the implants. The 24 words were read from the device screen by a hidden microcontroller, which then decoded them and used an embedded SIM, or eSIM, to send the data over an LTE connection.

The wallet can be restored and its data taken over by anyone with the full recovery phrase. Therefore, in order to access the victims' cryptocurrencies, the attackers did not need to take the actual device or intercept a transaction.

Donjon, Ledger's security research team, verified that the implant functioned without reference to the operating system or Secure Element of the wallet. It did not alter transaction signatures or damage the internal infrastructure of the business.

The modified devices could pass Ledger's authenticity checks because of this distinction as well. A successful authenticity verification did not ensure that the entire device was devoid of illicit hardware because the original security chip was still there.

Is my Ledger safe, or is there a spy implant in it? Detecting a spy implant without cracking your device open is possible. I'm working on a device to make it cheap and easy, and will publish the PCB and specs so anyone will be able to build it. https://t.co/w92iOkWAbr

— Mark Karpelès (@MagicalTux) October 18, 2026

Mark Karpelès Challenges Ledger Over Earlier Security Warnings

The former CEO of the collapsed Mt. Gox exchange, Mark Karpelès, criticised Ledger for apparently not disclosing the risk quickly enough. He argued that as situations of harmful hardware implants surfaced, the company ought to have released more explicit warnings.

After Karpelès cited previous security discussions and records about changed hardware wallets, the argument grew more heated. He questioned if consumers had been adequately informed about the potential for implants to avoid the device's regular authenticity tests.

In the past, Ledger had released guidelines advising customers to make purchases through its official store or approved resellers. Karpelès claimed that more comprehensive alerts regarding physical alterations might have enabled users to identify the danger earlier.

Pascal Gauthier, CEO of Ledger, reacted strongly, dismissing Karpelès as a purported white knight and telling him that software could not secure the entire planet. A technical security probe became a public dispute over accountability, disclosure, and customer protection as a result of the exchange.

The main point of disagreement is not whether the implant actually existed, as Ledger attested to, but rather whether the business sufficiently disclosed the risk before the event that caused reported financial losses.

> "The Secure Element chip is designed to detect physical tampering and will refuse to execute unsigned code or pass the genuine check if extra hardware attempts to intercept signals."

Not only is this misleading consumers into believing the Secure Element can detect "extra hardware," but Ledger's own documentation explicitly states:

> "Note that a Genuine check cannot detect unauthorized physical modifications to the hardware, such as spying implants, if the original Secure Element remains intact."

@Ledger_Support's statement directly contradict Ledger's own technical documentation, and less than two months later, we're seeing reports of over $90 million stolen through precisely the kind of "extra hardware" intercepting signals that Ledger assured customers would be detected.

And here's the worst part: Ledger had already published photographs of actual spying implants in its March 2026 Ledger Academy article, including sophisticated, mass-produced PCBs installed in multiple Ledger models.

This wasn't some hypothetical attack they hadn't anticipated. They had already documented the threat, yet months later, their official Support account was assuring customers that Genuine Check would detect precisely this kind of hardware modification.

How is this not misleading advertising?

https://t.co/0smPWJYBFx

— Mark Karpelès (@MagicalTux) October 18, 2026

Ledger Suspends Reseller Sales as Crypto Losses Come Under Investigation

Ledger requested that CryptoBilis stop shipments and sales while its security team looked into the impacted devices. Additionally, as a precaution, the company asked distributors and resellers in Hong Kong and Southeast Asia to stop selling Ledger products.

According to Ledger, devices sold by CryptoBilis were involved in all verified fund losses related to the October 9 incident. However, its early inquiry reports did not confirm the total number of impacted users or the overall amount of financial harm. The losses, according to independent assessments, were in the tens of millions of dollars.

The company insisted that there had been no sacrifice to its own technology, services, or direct sales channels. Modifications made after the devices had left its control were blamed for the tragedy.

It was recommended that customers who bought Ledger devices from CryptoBilis refrain from initialising any units that were not in use. Individuals who have previously configured impacted devices were advised to contact official Ledger support and transfer their assets to a new wallet using a freshly issued recovery phrase.

Concerns over reseller monitoring were also brought up by the occurrence. If a genuine product is physically changed before sale, it can still become dangerous even if it was acquired through an authorised distribution channel.

Source: Ledger

Karpelès Develops an Open Source Detector for Hardware Wallets

Karpelès is developing a detector that will find questionable parts in hardware wallets without requiring customers to take their devices apart. Resonance testing and low-power wireless signals are used in the proposed architecture to identify abnormal internal antenna structures.

He has stated that the technical specifications and circuit board design will be made publicly available so that other researchers and technically proficient consumers can study or replicate the device.

The project fixes a particular flaw that the event revealed. Although software authenticity tests can verify the characteristics of a wallet's original security hardware, they might not be able to detect an extra part that has been covertly put inside the case.

A dedicated physical inspection tool could provide another way to investigate suspicious devices, although the detector has not yet been released as a fully tested product with independently verified results.

The proposal also raises a practical question for hardware wallet manufacturers. If a device can pass its normal authenticity checks despite containing a hidden transmitter, manufacturers and distributors may need stronger physical inspection procedures alongside existing software and chip-level protections.

If you find any issues in this article or notice missing information, please feel free to reach out at team@etherworld.co for clarifications or updates.

To promote your Web3 articles, events, and projects, you may reach out anytime via EtherWorld PR for submissions and collaboration.

Related Articles

1. Dubai VARA Approves Kraken Parent Payward
2. Coinbase Wants Employees to Build AI Models Without Writing Code
3. Gnosis Chain Activates Ethereum Fast Confirmation Rule
4. Starknet Targets Quantum Resistance by 2027
5. 79thVault Loses $12.5M in 79AU Hot Wallet Hack

To follow blockchain news, track Ethereum protocol progress, and read our latest stories, subscribe to our weekly today.

Join the EtherWorld & Avarch Internship Program and build your career in blockchain, content, social media, video, podcast editing, or operations. Send your resume and brief introduction to contact@etherworld.co.