Ledger users warned of potential implant in Malaysian devices

A hardware wallet is supposed to be the vault. According to Mark Karpelès, at least one Ledger bought in Malaysia came with a stowaway built into the vault door.

On October 9, 2026, the former Mt. Gox CEO posted photos of a Ledger device he said contained a hidden physical implant tucked into the screen padding. The same day, Ledger said it had opened an investigation into reported user losses tied to a Southeast Asian reseller called CryptoBilis.

What Karpelès says he found

The alleged implant was not a crude add-on. Karpelès claimed the device held LTE components, an antenna, an eSIM, and a microcontroller, all concealed in the buffer pad area behind the screen.

That microcontroller was reportedly wired to the Ledger’s SPI bus. Think of the SPI bus as the internal hallway that chips use to pass messages to each other, including what gets sent to the display.

According to the research findings, this setup allegedly lets the device watch the display and transmit sensitive data, such as seed phrases, over cellular networks. A seed phrase is the master key to a crypto wallet. Whoever has it can move the funds, and the original owner has no customer support line to call.

Ledger pauses CryptoBilis sales

Ledger’s response focused on the sales channel. The company said it began investigating after reports of substantial losses among users who bought devices from CryptoBilis, a reseller based in Malaysia.

Ledger instructed CryptoBilis to stop all sales. It also told customers who purchased through that channel not to initialize their devices.

That second instruction matters most. Initializing is the moment a hardware wallet generates and displays a new seed phrase. If the device is compromised, that is exactly when the secret would be exposed.

The scale of the damage is still an estimate. Pseudonymous analyst Specter put losses at more than $86 million across multiple wallets on Bitcoin, Ethereum, and TRON. Those figures have not been independently confirmed.

The source material does not establish that the device Karpelès photographed was sold by CryptoBilis. The two disclosures landed on the same day and point to the same region, but they remain separate threads for now.

Not the first time this year

Reports of hardware implants inside Ledger devices have surfaced earlier in 2026, including notable cases out of Thailand. A pattern is starting to form, and it runs through Southeast Asian resale channels.

Karpelès is a familiar name delivering an unfamiliar warning. He led Mt. Gox, one of the most notable collapses in crypto’s history.

What this means for hardware wallet buyers

Based on the available findings, this looks like a reseller problem, not a flaw in Ledger’s core product. That distinction is real, but it may offer limited comfort to anyone who already handed over their savings to a tampered device.

The attack described here sidesteps the security that hardware wallets are known for. The secure chip can do its job perfectly and still lose the fight if someone is reading the screen it talks to.

Users are being urged to purchase directly from Ledger’s official channels and to follow the company’s inspection guidance to check device integrity. Anyone who bought from CryptoBilis should hold off on setting up the device, per Ledger’s instruction.

For Ledger, the next steps to watch are the results of its investigation and whether it confirms or revises the loss estimates. The company’s handling of affected CryptoBilis customers will also shape how much trust survives this episode.