Mark Karpelès, former CEO of Mt. Gox, stated that French hardware wallet manufacturer Ledger received multiple reports of malicious hardware implants months before its recent security crisis became public. According to Karpelès, at least two individuals contacted Ledger regarding tampered devices as early as December 2025, yet he noted no public warnings were issued by the company in response to these initial alerts.
Security researcher Joe Grand corroborated this timeline, revealing he alerted Ledger on March 4, 2026, about a malicious implant found in a Nano X device purchased through Lazada Thailand in August 2025. While Ledger acknowledged Grand’s findings and initiated an internal investigation, Grand criticized the firm for failing to proactively warn customers about the emerging threat. The broader security crisis surfaced on October 9, when crypto losses were reported involving wallets sold through CryptoBilis, an authorized Southeast Asian reseller. Ledger confirmed that one affected device contained an unauthorized implant but declined to comment specifically on its handling of Grand’s earlier disclosure.
The incident highlights vulnerabilities in third-party marketplace sales channels. OneKey’s head of sales, Archie, explained that platforms like Lazada host numerous independent sellers, making it difficult for consumers to distinguish authorized stores from rogue listings. Following the recent incidents, OneKey removed its reseller listings pending stricter checks, arguing that manufacturers must take responsibility for protecting customers rather than relying on buyers to identify trustworthy sellers. Additionally, Grand reported alerting competitor Trezor in August 2026 about tampered devices purchased from unauthorized sellers on TikTok and Facebook. Trezor responded that while counterfeit wallets occasionally appear through unauthorized channels, their previous statements regarding compromised devices applied only to new wallets sold through authorized resellers.
Ledger’s delayed public communication following early private disclosures suggests a potential gap between internal risk assessment and external customer protection protocols. By acknowledging specific implant reports in March 2026 without issuing immediate warnings, the company may have prioritized internal verification over proactive transparency, leaving users exposed to known supply chain risks for several months. This approach contrasts with competitors like OneKey, which moved to suspend reseller listings entirely to mitigate uncertainty, indicating divergent strategies in managing reputational and operational risk during security crises.
The reliance on authorized reseller status as a primary trust signal appears insufficient given the complexity of modern e-commerce platforms. As evidenced by the involvement of unauthorized sellers on marketplaces like Lazada, TikTok, and Facebook, the boundary between official distribution and third-party resale is increasingly blurred for consumers. For hardware wallet manufacturers, the implication is clear: verifying the integrity of the supply chain requires more than just certifying resellers; it demands active monitoring of marketplace listings and rapid, transparent communication when anomalies are detected, regardless of whether the source is officially authorized.
