Ledger CEO Pascal Gauthier has publicly clashed with former Mt. Gox chief Mark Karpelès over warnings about modified hardware wallets linked to an estimated $90 million in cryptocurrency thefts.
Summary
- Ledger CEO Pascal Gauthier challenged Mark Karpelès after criticism of the company’s warnings about tampered wallets.
- Karpelès pointed to a March security guide, but its September update leaves the original content uncertain.
- Ledger acknowledges its Genuine Check cannot detect added spying components when the original security chip survives.
- Researchers estimate losses above $90 million, although Ledger has not confirmed the final amount stolen publicly.
- The company paused CryptoBilis sales after investigators discovered devices modified to capture wallet recovery phrases remotely.
In an October 17 exchange on X, Karpelès questioned whether the wallet manufacturer had communicated the danger of sophisticated spying implants clearly enough before customers reported losses involving devices sold through Southeast Asian reseller CryptoBilis. Gauthier defended Ledger’s security work and challenged the former exchange executive’s criticism.
The dispute followed the discovery of unauthorized electronics inside a genuine Ledger device. Investigators found that the additional hardware could capture a wallet’s 24-word recovery phrase during setup and transmit it through a cellular connection.
Research estimates place the suspected losses above $90 million. Ledger has not established that figure as a final verified total, and Karpelès’s claim that earlier warnings could have prevented those losses remains unproven.
Ledger CEO disputes Karpelès’s criticism of wallet warnings
The disagreement began with Karpelès questioning Ledger’s earlier communication about physical modifications to its hardware wallets.
In a post on October 17, he corrected a previous assertion that Ledger had not discussed such implants before the latest incident.
Karpelès acknowledged that the company had published a security article in March covering risks associated with tampered devices. However, he argued that publishing guidance in an educational section was insufficient given the sophistication of the devices later discovered.
He said a more prominent warning could have prevented over $90 million in losses. Gauthier responded that the company works extensively to protect customers and that outsiders should distinguish established evidence from speculation. The Ledger CEO wrote that the job was difficult, acknowledged Karpelès’s contribution to the discussion and asked him to limit his comments to what he could substantiate.
The exchange became more confrontational when Gauthier referred to Karpelès’s previous leadership of the failed Mt. Gox exchange. “Coming from Mt Gox CEO… Come on man. You are no white knight. Get real,” Gauthier wrote, according to the posts supplied with the dispute.
Mt. Gox collapsed in 2014 after massive Bitcoin losses, leaving creditors facing a lengthy recovery process. Karpelès responded that his own experience with a major exchange failure was a reason to expect stronger security communication from companies handling customer assets.
The public disagreement concerns Ledger’s response to the threat. It does not establish that the company intentionally concealed information about the CryptoBilis attack.
March Ledger guide raises questions about earlier knowledge
The security article at the center of the dispute is titled Best Practices To Securely Buy Your Ledger Signer. Ledger’s website lists March 6, 2026, as its original publication date and September 18 as its latest update.
The current version explains several ways criminals can interfere with hardware wallets before they reach customers. It covers counterfeit devices, wallets shipped with preselected recovery phrases and genuine devices modified after leaving the factory.
Its section on physical tampering describes attackers adding unauthorized components that can capture information displayed during wallet setup.
The page contains images of modified electronics, including examples of circuit boards and components concealed inside wallet hardware.
Karpelès pointed to those illustrations when arguing that Ledger had encountered sophisticated implant designs months before the October revelations.
However, the article’s September revision creates an unresolved question. The currently accessible version does not establish when each photograph or technical warning was added. Without a preserved copy of the March publication or a detailed revision history, the images cannot independently prove what Ledger knew about the specific CryptoBilis attack at that time.
Knowledge of a general method for modifying hardware wallets is not the same as documented awareness that criminals had placed such devices into a reseller’s inventory. The available material does not establish when Ledger first learned of the affected CryptoBilis devices or whether the security article referred to those particular implants.
The dispute therefore centers partly on the difference between publishing general security guidance and issuing a warning tied to a specific threat.
Genuine Check cannot detect every hidden implant
Ledger’s own documentation confirms an important limitation of its device authentication system. The company’s Genuine Check verifies the cryptographic identity of the Secure Element, the protected chip used to perform sensitive wallet operations.
During setup, Ledger’s software sends a verification request to the device. The Secure Element responds using a unique cryptographic signature associated with its original manufacturing process.
A successful response confirms that the device contains an authentic security chip. The check does not inspect every physical component inside the wallet or establish that nobody has modified the device after production. Ledger’s security guide states that the authentication process cannot detect unauthorized physical additions when the original Secure Element remains intact.
In the CryptoBilis case, the malicious electronics reportedly operated alongside the legitimate hardware, allowing the device’s original security features to remain functional. Investigators described an implant positioned near the screen that could capture the recovery words presented during initialization.
A recovery phrase allows a wallet owner to restore control of cryptocurrency addresses. Anyone who obtains the complete phrase can potentially access the associated funds without possessing the original device.
The reported implant used cellular connectivity to transmit captured information, avoiding the need for the attacker to retrieve the wallet physically after setup.
Ledger said the discovery did not demonstrate that its Secure Element, operating system or transaction-signing process had been compromised.
The reported attack instead involved physical interference with devices during distribution. Earlier crypto.news coverage of the implant detailed how the additional electronics could read recovery words without replacing the protected security chip.
A separate report on the investigation documented Ledger’s confirmation of an unauthorized component in a customer device.
CryptoBilis investigation continues amid disputed loss estimates
Ledger began investigating complaints from customers who had purchased hardware wallets through CryptoBilis, a reseller operating in Southeast Asia.
On October 9, the company asked CryptoBilis to suspend sales and shipments while investigators examined reports of missing cryptocurrency. Customers who purchased devices from the reseller within the preceding 90 days were advised against initializing unused wallets.
Ledger recommended that affected customers who had already set up their devices move funds to a wallet generated using a new recovery phrase on a trusted device. Its investigation subsequently confirmed that at least one examined wallet contained unauthorized electronics capable of collecting recovery information. The reported theft total has varied across independent estimates as investigators identify potentially connected addresses and transactions.
Galaxy Research described approximately $91 million in suspected losses in its October 16 analysis. That figure should not be treated as the amount conclusively stolen through every modified Ledger device or as a verified measure of what earlier warnings could have prevented. Reports of a tampered wallet in Germany led retailers to examine their distribution arrangements as the investigation continued. The incident has therefore involved questions about reseller oversight as well as the technical protections built into individual devices.
Ledger’s current purchasing guidance recommends buying directly from the company or through authorized sellers, checking for visible tampering and completing authentication through official software. It cautions that authorized distribution and a successful Genuine Check cannot guarantee that a wallet has never been physically modified.
The company’s documented rules prohibit authorized resellers from putting returned devices back into inventory for resale. Its security guide was updated on September 18, several weeks before the public CryptoBilis investigation began in October.
Other Articles
No Comment! Be the first one.