Ledger hardware wallet tampering reports date back to at least December 2025, former Mt. Gox CEO Mark Karpelès said on October 16, 2026. He questioned Ledger’s response, telling Cointelegraph he knew of at least two people who had contacted the company about altered devices but had seen no subsequent public warning.
Karpelès urged Ledger to alert customers more proactively, arguing that the growing number of reports and increasingly sophisticated attacks warranted action. His criticism concerned devices fitted with malicious hardware components.
Ledger hardware wallet tampering: reports and response
Security researcher Joe Grand said he notified Ledger on March 4, 2026, about a compromised Nano X bought through Lazada in Thailand. The purchase took place in August 2025, months before his disclosure to the manufacturer.
Grand said Ledger acknowledged his findings and told him it was conducting an internal investigation. He also criticized the company’s failure to proactively alert customers about the threat, echoing Karpelès’ concern about public communication.
A separate security incident disclosed on October 9, 2026, involved cryptocurrency losses linked to wallets sold through CryptoBilis, an authorized reseller in Southeast Asia. That incident followed the earlier reports described by Karpelès and Grand.
The Ledger hardware wallet tampering reports span both an online marketplace purchase and devices sold by an authorized reseller. Ledger confirmed that one device affected in the CryptoBilis incident contained an unauthorized implant.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.