French hardware wallet vendor Ledger has faced mounting scrutiny over how quickly it responded to reports of malicious “implants” affecting devices sold through third-party marketplaces. According to Mark Karpelès—former CEO of the now-collapsed Mt. Gox—he was aware of tampering alerts reaching Ledger months before the company’s latest public security crisis came to light.
The issue resurfaced on Oct. 9, after crypto losses were reported involving wallets sold through CryptoBilis, a Southeast Asia reseller that Ledger has described as authorized. Ledger confirmed that at least one affected device contained an unauthorized implant, according to Cointelegraph’s reporting.
Key takeaways
- Mark Karpelès says multiple parties warned Ledger about potentially tampered devices months before Ledger’s October security developments.
- Security researcher Joe Grand reported a malicious implant in a Ledger Nano X to Ledger on March 4, 2026, after the device was bought on Lazada in August 2025.
- Grand criticized Ledger for not proactively warning customers about the threat despite acknowledgement of his findings.
- Marketplaces like Lazada and social platforms can complicate reseller verification, blurring the line between authorized stores and independent listings.
- Trezor says it treats reports tied to unauthorized sellers as early indicators and uses researchers’ findings to strengthen its own checks.
Earlier warnings allegedly reached Ledger before the public crisis
Karpelès told Cointelegraph that he had information about tampered Ledger devices reaching the company as far back as December 2025. He said he was aware of at least two individuals who contacted Ledger about compromised hardware wallets during that period.
In Karpelès’ account, the absence of a public Ledger warning in response to those earlier reports is notable. He suggested that the pattern and quality of incoming alerts should have prompted clearer customer guidance sooner, especially as technical sophistication appeared to increase.
Cointelegraph also reported that when Joe Grand escalated his findings, Ledger acknowledged his disclosure and said it was investigating internally. Ledger declined to comment when asked about its handling of Grand’s disclosure and instead directed Cointelegraph to its public statements on X.
“However the increasing number of reports they must have received, and the increasing quality/technology used should have alerted them enough to act, and at least remind customers to be careful.”
A researcher’s disclosure highlights the stakes of marketplace purchases
Joe Grand, a security researcher, told Cointelegraph that he alerted Ledger on March 4, 2026, about a malicious implant in a Ledger Nano X. Grand said he identified the issue in a device purchased through Lazada Thailand in August 2025.
Grand’s presentation, shared with Cointelegraph, tied the tampered device to a Lazada seller labeled “LedgerXXX.” However, at the time of writing, Ledger’s official page listing authorized resellers in Thailand did not show “LedgerXXX” as an authorized entity—though Lazada’s own Ledger storefront appeared in place.
The distinction matters for users because hardware wallets are designed to be a trust anchor. When devices are allegedly modified before purchase, the security model breaks at the point where buyers assume the hardware came from a legitimate channel. Karpelès’ comments and Grand’s critique center on a perceived gap between internal investigation and public customer protection.
Cointelegraph attempted to clarify the seller identity and authorization status with both Grand and Ledger regarding how the device was procured.
How reseller verification gaps can shift risk onto buyers
Other industry participants argued that marketplace design can make it difficult for customers to identify legitimate distribution. Archie, head of sales at OneKey, told Cointelegraph that platforms such as Lazada host many independent sellers, and customers may struggle to distinguish authorized stores from unrelated listings.
Following the most recent incidents, OneKey removed its reseller listings on marketplace channels pending stricter checks. The company’s approach, as summarized by Cointelegraph, places responsibility on manufacturers and brands to protect customers rather than relying entirely on shoppers to validate seller trustworthiness.
The underlying friction is that marketplaces typically encourage third-party selling at scale, while authorized reseller relationships are narrower. When tampered devices appear through unauthorized listings, the burden of selection shifts back to consumers—despite the fact that hardware wallet security depends on the assumption that the buyer received authentic, untampered equipment.
Security concerns extend beyond Ledger, prompting platform-wide vigilance
Grand’s work was not limited to Ledger. Cointelegraph reports that he also alerted Trezor in August 2026 about tampered Trezor One and Model T wallets purchased through unauthorized sellers on TikTok and Facebook.
Trezor told Cointelegraph that counterfeit hardware wallets sometimes appear through unauthorized sellers. The company pointed to a 2022 warning about modified devices sold on Russian marketplaces. Trezor also said that a recent claim of no evidence of compromised devices applied only to new wallets sold through authorized resellers.
In other words, even if tampering reports do not indicate broad compromise across the official supply chain, devices sourced through unauthorized channels can still create a separate risk category—often acting as an early warning system for emerging tactics.
Trezor said it treats reports involving unauthorized sellers as early indicators, and it uses researchers’ findings to improve security checks. The company emphasized that changes become most urgent when a new technique appears through authorized channels, or when cases start arriving via legitimate distribution networks.
“What changes the picture is a new technique, or a first case coming through an authorised channel,” Trezor said. “Either one means the problem has moved closer to ordinary buyers, and that’s when we’d move fastest, including warning customers directly.”
What readers should watch next
Going forward, investors and users should focus on how manufacturers communicate when credible tampering reports surface—especially whether warnings are issued quickly enough to reduce harm. The key uncertainty remains how widespread these implants are across distribution channels, and whether future updates will clarify what proportion of incidents trace back to authorized resellers versus independent marketplace listings.
Be the first to comment