Skip to content
Cryptocurrencies

Mt. Gox’s Disgraced Ex-CEO Finds Redemption Exposing ‘Spy Implants’ in Ledger Devices

Karpelès has been posting about “spy implants” found in Ledger’s crypto hardware wallets for nearly a month.
By

Reading time 6 minutes

Comments (0)

Bitcoiners and other crypto users are still reeling, and in many cases sliding into a deep state of paranoia, after Ledger confirmed that at least one hardware wallet sold through CryptoBilis, an authorized Ledger reseller in Southeast Asia, was backdoored with a hidden hardware implant.

“Ledger can confirm that one of the impacted users’ devices contained an unauthorized hardware implant,” Ledger Support wrote on X on Saturday.

At the same time, the disgraced former head of Mt. Gox, the infamous bitcoin exchange that collapsed into bankruptcy in 2014 after losing roughly 850,000 bitcoin (worth about $272 million by the end of that year), is enjoying an unlikely redemption arc. Mark Karpelès, who was convicted in 2019 of falsifying data but acquitted of embezzlement and given a suspended sentence in relation to Mt. Gox, was already on the case in the middle of last month. “Spy implant in @Ledger Nano X, back in the days and now, that’s quite an evolution,” he posted on September 16th, alongside photos of an older implant and a newer one.

He brought it up again on Thursday, roughly a day before Ledger’s first public warning about the issue. “Need free data? Buy a cheap ledger off a dodgy seller, pull the sim out of the spy implant and enjoy while you can (law enforcement may visit you thinking you are the one making these),” Karpelès wrote.

Updated loss estimates related to the Ledger supply chain attack, which originally became apparent to crypto users on Friday, now sit at $93.2 million taken from 315 wallets across six blockchains, according to an on-chain investigation by Bitquery updated early Sunday. To be clear, that’s a third-party estimate, not an official figure from Ledger. Tether froze about $10 million of the stolen USDT, according to pseudonymous on-chain investigator tanuki42.

From Bitcoin Villain to Hero

For years, Karpelès was arguably Bitcoin’s biggest villain due to his role in the Mt. Gox collapse and how he handled it. As recently as February, he was mocked for proposing a hard fork of Bitcoin to recover coins stolen from the exchange.

Now he’s collecting praise from across the Bitcoin ecosystem, due to a belief that his posts may have spooked Ledger’s supply chain attackers into draining wallets sooner than they otherwise would have. For now, that theory remains unconfirmed.

“It is reasonable to assume that @MagicalTux doing physical audits of ledgers from resellers, to then find tampered hardware, identifying the supply chain attack saved hundreds of millions of dollars (if not billions one day) of wealth,” AnchorWatch CEO Rob Hamilton wrote. “I salute you sir 🫡”

Foundation CEO Zach Herbert, whose company makes competing Passport hardware wallets, agreed. “Yes very impressive, the attack could have gone on for years unnoticed,” Herbert replied.

How Karpelès Found the Implants

Karpelès’s own devices didn’t come from CryptoBilis, which was the authorized Ledger reseller at the center of initial reports on the incident. He explained on Friday that he had been looking into an increase in cheap Ledger wallets on Amazon and other platforms, assuming they’d be compromised. “One didn’t come, two had spy implants,” he wrote. His research page says the two implanted units came from Yahoo! Auctions in Japan and from a China-based seller on Amazon Japan that shipped from Malaysia.

Karpelès explained that the malicious implant reads the seed phrase off the data sent to the screen during setup and sends it out over a cellular connection. Since Ledger’s alert, Karpelès has reviewed photos from CryptoBilis buyers and says their devices contain the same class of implant as his. It’s unclear how long these tampered devices have been circulating. His research page traces the first public report of an implanted Nano X to August 2025, and crypto educator Tai Zen claims he sent multiple compromised Ledgers to the company’s security team as far back as January. Tai Zen hasn’t published photos to back that up, and Ledger hasn’t confirmed receiving the devices.

“Implanted devices mean your seed phrase is known by an attacker. The attacker may decide to steal your assets today, or in a year,” Karpelès warned.

Longtime Bitcoin developer and researcher Peter Todd says he argued with Ledger years ago that its device authenticity checks couldn’t catch a compromised screen interface and that it needed tamper-evident shipping. “As usual, looks like I was eventually proven right,” Todd wrote.

What Ledger Has and Hasn’t Confirmed

So far, Ledger has confirmed one implant in one affected user’s device. It hasn’t said how many devices were tampered with, and it hasn’t tied the implant to the third-party loss estimates. “The volume of impacted devices is limited,” the company said in a 72-hour update on Sunday afternoon, adding that it is working with authorities. Earlier in the day, Ledger said, “There is no indication that devices purchased on Ledger.com have been tampered with.”

Still, Karpelès finding implants in devices that never passed through CryptoBilis is very bad news because it means this is potentially a more widespread problem than it was initially thought to be, though Ledger says all confirmed cases tied to Friday’s draining involve CryptoBilis devices.

Another X user, @0xJohannes_, claimed on Sunday that a Ledger he bought in a store from an official reseller in Europe also has extra wiring inside. He later said in a reply that he bought it at electronics retailer MediaMarkt, and he suggested a tampered unit may have been returned to the store and resold. Ledger replied to him on Sunday afternoon by pointing to its 72-hour update, which says, “We are reminding our authorized resellers and distributors to source products only through authorized channels and never to restock returned products.”

Judging from the photos, Karpelès called it an earlier version of his implant. “The antenna reads ‘欧亚版 (Ōuyà bǎn),’ meaning ‘Eurasian version’, so there could be more out there. I’m guessing they had to make different versions depending on the available LTE frequencies in each region,” Karpelès wrote.

Questions Over CryptoBilis’s Ownership

CryptoBilis’s former co-founders say they no longer run the company, according to a statement that Karpelès’s research outfit, Tibane Labs, says co-founder Arravind Prabu sent via LinkedIn in reply to its request for comment. The veracity of this has not been confirmed by Gizmodo.

The statement says CryptoBilis was acquired by new owners earlier this year and that the co-founders handed over all responsibilities and system access in March. “Under the formal acquisition agreements, all parties were contractually bound to hold off on issuing a joint public announcement until mid-October 2026,” it adds. A matching version of the statement appeared on a LinkedIn page under Prabu’s name.

The statement also names Nicholas Chang, with a CryptoBilis email address, as the company’s current lead person in charge, but it doesn’t identify the new owners, and nothing confirmed ties them to the theft. Ledger’s Saturday update said CryptoBilis has stopped selling all of its hardware wallet inventory during the investigation, and Ledger competitor Trezor has removed CryptoBilis from its reseller list, despite no similar confirmed cases involving their devices.

Crypto Enters Bunker Mode

The greater Bitcoin and crypto ecosystem has been on edge since the Ledger incident, which itself caps a year of lost trust in the security of DeFi protocols and a variety of extremely troubling incidents involving base Bitcoin and crypto infrastructure. There was the Coldcard firmware hack, claims that AI could break one of Bitcoin’s signature schemes, and a record number of crypto project hacks in April. Add in the quantum threat, increasingly common $5 wrench attacks, and multiple inflation bugs, including the Liquid Network exploit and flaws in Zcash and XRP (the latter of which was just disclosed on Friday) that could have let attackers print coins out of thin air.

On top of everything going on with Ledger, Coldcard now believes a phishing link posted from its X account early Sunday may have come from within X itself, as the company says the account’s two-factor authentication is kept offline. “A phishing post appeared on our account, yet we can find no corresponding login, session, or access record. Our credentials and offline 2FA remain secure. This raises concern about unauthorized platform-level or administrative access,” Coldcard wrote. The company also cited reports of X admin access being sold on darknet markets, while admitting it can’t verify a connection. X hasn’t publicly responded.

Hardware wallet makers have also been using the Ledger situation to market their own products and trade jabs. Tangem, which sells card-style wallets with no screen or battery, declared, “Supply chain attacks simply don’t apply to a Tangem card.” Ledger co-founder Nicolas Bacca, who now works on ZKNOX, wasn’t buying it. “In that case you might as well use a mobile wallet because Tangem adds no extra security,” he wrote in French to a Tangem promoter.

Coldcard, meanwhile, pointed to the value of its transparent design after the Ledger news broke. “A clear case is not decoration. It lets you inspect a COLDCARD for a component swap or implant,” the company wrote.

Despite all the paranoia, the bitcoin price has been relatively resilient. Bitcoin hit its all-time high of more than $126,000 a year ago almost to the day, and while it’s down roughly 34% since then (currently trading around $83,800), it may have already bottomed after dipping below $60,000 in June, roughly matching its February low, when economist Paul Krugman was on TV talking about how the end of bitcoin was, once again, upon us.

Explore more on these topics

Share this story

Sign up for our newsletters

Subscribe and interact with our community, get up to date with our customised Newsletters and much more.

Related Articles