Ledger's alarm clock snoozed while tampered wallets slipped through the reseller nap 😴

Hardware wallet manufacturer Ledger received multiple warnings about tampered devices months before its current security incident became public, according to statements gathered by Cointelegraph. Mark Karpelès, former CEO of the defunct Bitcoin exchange Mt. Gox, said he knew of two individuals who contacted Ledger about suspected implants dating back to December 2025. Karpelès added that he had not seen a public warning issued by the company in response.

Security researcher Joe Grand told Cointelegraph he notified Ledger on March 4, 2026, of a malicious implant in a Nano X purchased through online marketplace Lazada Thailand in August 2025. Grand said Ledger acknowledged the report and indicated an internal investigation was underway, but criticized the firm for not issuing a proactive customer alert. Vietnamese crypto educator Tai Zen also contacted Ledger about a suspected implant in December 2025, according to Karpelès.

Ledger's security crisis surfaced publicly on Oct. 9, when crypto losses were reported involving wallets sold through CryptoBilis, a reseller authorized in Southeast Asia. Ledger has confirmed that one affected device contained an unauthorized implant. When asked about its handling of Grand's disclosure, Ledger declined to comment and referred Cointelegraph to its public statements on X.

"Maybe Ledger not responding to a single event of an implant found on a Ledger purchased from a shady dealer is normal," Karpelès said, adding, "However the increasing number of reports they must have received, and the increasing quality/technology used should have alerted them enough to act, and at least remind customers to be careful."

Grand's research further identified the Lazada seller of the tampered device as "LedgerXXX," which was not listed as an authorized Ledger reseller in Thailand at the time of writing, though Lazada's official Ledger storefront was. OneKey's head of sales, Archie, told Cointelegraph that platforms such as Lazada host numerous independent sellers, making verification difficult for buyers, and OneKey has since pulled its own reseller listings pending stricter checks.

Grand's findings extended beyond Ledger. In August 2026, he also alerted Trezor about tampered Trezor One and Model T wallets purchased from unauthorized sellers on TikTok and Facebook. Trezor told Cointelegraph that counterfeit wallets occasionally appear through unauthorized channels, echoing a 2022 warning the company had issued about modified devices.