Former Mt. Gox chief executive Mark Karpelès has criticized Ledger for not issuing stronger public warnings about hardware wallet tampering after receiving multiple reports dating back to December 2025. The comments follow confirmation of an unauthorized implant in at least one device sold through an authorized reseller and come amid tracked outflows totaling more than $100 million from affected wallets.

Early Reports and Internal Notifications

Karpelès stated that Ledger was contacted by at least two individuals about suspected altered devices as early as December 2025. One of those contacts was Vietnamese crypto educator Tai Zen. Security researcher Joe Grand separately notified the company on March 4, 2026, after discovering an implant in a Ledger Nano X he purchased in August 2025 through the Lazada marketplace in Thailand. Grand identified the seller as LedgerXXX. At the time of later checks in October 2026, that seller no longer appeared on Ledger’s authorized Thai reseller list, though a Lazada storefront for Ledger remained listed.

Ledger acknowledged Grand’s findings and indicated it had opened an internal investigation. Both Karpelès and Grand expressed concern that the company did not move more quickly to alert customers about the risk of devices fitted with malicious hardware components after they left the manufacturer’s control.

Authorized Reseller Incident and Confirmed Implant

A separate incident became public on October 9, 2026, involving cryptocurrency losses connected to wallets sold through CryptoBilis, an authorized reseller operating in Southeast Asia. Ledger confirmed that one affected customer’s device contained an unauthorized implant. The company has stated that the attacks occurred after devices left its facilities and that its secure element chip, operating system, and servers were not compromised.

Ledger’s buyer guidance, first published on March 6, 2026, and updated on September 18, describes the Genuine Check process as a way to authenticate the secure element. The guidance notes that this check cannot detect physical tampering of other components when the chip itself remains genuine. It advises customers to purchase devices directly from Ledger or from authorized resellers.

Tracked Outflows and Preventable Losses Claim

A tally across six blockchains identified approximately $102 million in outflows from 335 wallets as of the morning of October 16, 2026. The figure covers Bitcoin, Ethereum, TRON, BNB Chain, Polygon, and Solana and uses asset prices from October 9. It exceeds an earlier $86 million estimate after additional chains and addresses were included. The total also incorporates $10 million in Tether that the issuer froze; a freeze does not equate to funds being returned to the original owners. Ledger has not confirmed any aggregate loss amount or verified that all traced outflows resulted from implants.

Karpelès argued that more forceful customer warnings could have prevented losses exceeding $90 million. His estimate stands apart from the on-chain outflow tally, which measures movement rather than confirmed theft. He has also maintained a public catalog of 14 devices classified as tampered or counterfeit, naming seven sellers in the process.

Broader Context Among Hardware Wallet Makers

Grand also contacted Trezor in August 2026 regarding tampered Trezor One and Model T units sold through unauthorized channels on TikTok and Facebook. Trezor responded that its prior statement of no evidence of compromised devices applied specifically to new wallets sold through authorized resellers. The firm characterized reports involving unauthorized sellers as early warnings and indicated that a new technique or an incident involving an authorized channel would trigger a faster response, including direct customer alerts. Separately, OneKey removed its reseller listings while implementing stricter verification measures.

The sequence of reports, spanning unofficial marketplace purchases and at least one authorized reseller, has raised questions about the timing and scope of public communication by hardware wallet manufacturers when physical tampering is identified after devices leave their direct control.