TLDR
- About $90 million was reportedly stolen from tampered Ledger wallets sold by CryptoBilis, according to Santiment, though Ledger has not verified the total.
- Hidden LTE implants copied the 24-word recovery phrase during setup and sent it over an eSIM.
- Mark Karpelès says Ledger received warnings about tampered devices as early as December 2025.
- Trezor and OneKey cut ties with CryptoBilis and trimmed their reseller lists.
- Ledger says users who set up a CryptoBilis device should move funds to a new device with a new recovery phrase.
Ledger is facing questions about how it handled reports of tampered hardware wallets. Former Mt. Gox CEO Mark Karpelès says the French company was warned months before its current security crisis became public.
Former Mt. Gox CEO: Ledger Received Hardware Wallet Tampering Reports Since December 2025 but Issued No Public Warning
Former Mt. Gox CEO Mark Karpelès said Ledger had received reports of hardware wallets tampered with and fitted with malicious components since at least December… pic.twitter.com/Vmv4zXChEk
— Wu Blockchain (@WuBlockchain) October 16, 2026
Karpelès told Cointelegraph he knew of at least two people who contacted Ledger about tampered devices starting in December 2025. He said he has not seen any public warning from Ledger in response.
Security researcher Joe Grand says he told Ledger on March 4, 2026, about a malicious implant in a Nano X. He bought the device through Lazada Thailand in August 2025. Ledger said it was investigating, but Grand criticized the company for not warning customers.
Ledger declined to comment on how it handled Grand’s report. It pointed Cointelegraph to its public statements on X.
How the Implant Stole Recovery Phrases
The crisis became public on October 9, when crypto losses were reported involving wallets sold through CryptoBilis, a reseller authorized in Southeast Asia. On October 13, Ledger’s Donjon security team confirmed the devices held hidden LTE implants.
A recovery phrase is a list of 24 words that can restore a wallet on any device. Ledger says the implant sits in a separate part inside the case. It reads the words from the screen during setup.
The implant then sends the phrase over a 4G network using a built-in eSIM. Ledger says the attack does not touch its Secure Element chip or change any transactions. Thieves can restore the wallet on their own device and move the funds.
Security firm Tibane Labs found three versions of the implant. It bought the third version from a Japanese online marketplace, and it shipped from Malaysia.
Losses and Reseller Fallout
Crypto analytics firm Santiment estimates about $90 million has been stolen. Blockchain investigator Specter puts the loss above $86 million across Bitcoin, Ethereum and Tron. Ledger says the figures come from third parties and it has not fully verified them.
Ledger says every confirmed case links to CryptoBilis. The reseller has paused hardware wallet sales until the investigation ends. Ledger also asked resellers across Southeast Asia and Hong Kong to stop selling.
Trezor said it found no tampered devices from CryptoBilis but ended ties anyway. OneKey revoked the reseller’s authorization and will replace devices bought between March 1 and October 13 for free. OneKey also removed its reseller listings pending stricter checks.
Grand also alerted Trezor in August 2026 about tampered Trezor One and Model T wallets from unauthorized sellers on TikTok and Facebook. Trezor said it treats such reports as early warnings.
Some claims remain unverified. Karpelès said a Ledger Flex bought at Singapore’s airport may have an implant. In Germany, MediaMarkt Saturn paused Ledger sales after a customer report, but no funds were lost.
What Ledger Owners Are Told to Do
Ledger’s Genuine Check cannot detect physical changes if the Secure Element is intact. A passing result does not rule out an implant. Ledger says users who set up a CryptoBilis device in the last 90 days should move funds to a new device with a new recovery phrase.
Ledger’s inspection of European retail stock found no signs of tampering. The company has not said how many users are affected or how the devices entered CryptoBilis’ stock. Bitcoin fell 0.4% and Ethereum fell 1.8% in the week ending October 16.
Stop guessing and start investing with confidence. KnockoutStocks gives you the AI insights, market intelligence, and stock research you need to spot opportunities, cut through the noise, and make smarter investment decisions — all in one powerful platform.
Sign up today and get 50% OFF full access to our premium stock picks.
Simply use coupon code SPECIAL50 at checkout to claim your exclusive discount.
