Mt. Gox’s Karpelès Calls Out Ledger Over Wallet Warnings in Heated X Fight

TLDR

• Ledger CEO Pascal Gauthier and ex-Mt. Gox chief Mark Karpelès argued publicly on X about warnings over tampered wallets.
• Karpelès says better warnings could have prevented more than $90 million in losses.
• Ledger admits its Genuine Check cannot spot added spying parts if the original security chip is intact.
• Galaxy Research estimated about $91 million in suspected losses, but Ledger has not confirmed a final total.
• Ledger says the attack is limited to Southeast Asia, while others say it reached further.

---

Ledger CEO Pascal Gauthier and former Mt. Gox chief Mark Karpelès traded public criticism on X on October 17. The dispute centers on warnings about modified hardware wallets tied to an estimated $90 million in crypto thefts.

Karpelès questioned whether Ledger had clearly warned customers about spying implants. Gauthier defended the company’s security work and asked critics to separate proven facts from guesses.

Correction: I said @Ledger didn’t talk about the implant situation at all despite knowing about it – they did publish an academy topic in March 2026 that talks about it and recommends buying direct or from Authorized Resellers.https://t.co/UUNH1H2L3D pic.twitter.com/UNrxyLnsmd

— Mark Karpelès (@MagicalTux) October 17, 2026

Karpelès said a better warning could have saved more than $90 million in losses. He also said Ledger received reports of spy hardware implants as early as December 2025.

Gauthier responded with a personal remark about Karpelès’ past. “Coming from Mt Gox CEO… Come on man. You are no white knight. Get real,” he wrote.

Mt. Gox collapsed in 2014 after large Bitcoin losses. Karpelès said that experience is why he expects stronger security communication from firms that hold customer assets.

What Ledger published and when

Karpelès pointed to a Ledger security guide titled Best Practices To Securely Buy Your Ledger Signer. Ledger’s site lists March 6, 2026 as the first publication date.

The guide covers fake devices, wallets with preset recovery phrases and genuine devices changed after leaving the factory. It includes photos of modified circuit boards.

The page was last updated on September 18. Without a saved copy of the March version, it is unclear when each photo or warning was added.

Ledger has not said when it first learned of the affected CryptoBilis devices. The public dispute does not show that the company hid information on purpose.

How the attack worked

Investigators found extra electronics inside a genuine Ledger device sold through CryptoBilis, a reseller in Southeast Asia. The hardware could capture a 24-word recovery phrase during setup.

It then sent the words over a cellular connection. Anyone with the full phrase can access the linked funds without the device.

Ledger says its Genuine Check only confirms the Secure Element chip is authentic. It cannot spot added parts if the original chip is still in place.

Ledger said the Secure Element, operating system and signing process were not compromised. On October 9, it asked CryptoBilis to pause sales and shipments.

Galaxy Research estimated about $91 million in suspected losses on October 16. Ledger has not confirmed a final total, and another report put losses above $100 million.

Ledger advised customers who bought from the reseller in the last 90 days not to set up unused wallets. Those who already did were told to move funds to a new wallet on a trusted device.

Karpelès says similar implants appeared in other regions and that he helped users check their devices. Ledger disputed reports of European exposure after reviewing a case in Germany.

Trezor and OneKey have removed third-party resellers and tightened distribution checks. Ledger maintains the compromise is limited to Southeast Asia, while others say it is wider.