Ledger faced implant warnings months before crisis, critics say
Early reports went unanswered
Ledger received multiple reports of tampered hardware wallets months before its latest security crisis broke in October, according to former Mt. Gox CEO Mark Karpelès. A hardware wallet is a physical device used to store cryptocurrency keys offline.
Karpelès told Cointelegraph he knew of at least two people who contacted Ledger about suspect devices as early as December 2025. He said he has not seen any public warning from the company about those early reports.
Security researcher raised alarms in March
Joe Grand, a security researcher, alerted Ledger on March 4, 2026, about a malicious implant found in a Nano X he bought through Lazada Thailand in August 2025. Ledger acknowledged the findings and said it was investigating internally, Grand said. However, he criticized the company for not proactively warning customers about the threat.
Ledger declined to comment on how it handled Grand's disclosure and referred Cointelegraph to its public statements on X.
Questions about reseller oversight
The tampered device Grand identified was sold by a seller called "LedgerXXX" on Lazada. That seller is not listed as an authorized reseller in Thailand, even though Lazada's official Ledger storefront is. This highlights a gap in how marketplaces vet third-party sellers.
Archie, head of sales at OneKey, told Cointelegraph that marketplaces like Lazada host many independent sellers, making it hard for customers to tell authorized stores from unauthorized ones. Following the recent incidents, OneKey removed its reseller listings to carry out stricter checks.
Trezor sees similar issues
Trezor also received reports of tampered wallets. In August 2026, Grand alerted Trezor about compromised Trezor One and Model T devices purchased from unauthorized sellers on TikTok and Facebook. Trezor said it had warned about modified devices on Russian marketplaces as far back as 2022.
Trezor clarified that its recent claim of no compromised devices applied only to wallets sold through authorized resellers. The company said it would move faster and warn customers directly if tampered devices appeared through authorized channels or if a new attack technique emerged.
What remains unclear
It is not clear whether Ledger took any internal action after receiving the early reports from Grand and others before the October crisis became public. Ledger has not publicly addressed how it handled those prior disclosures.
Why this matters for wallet users
The episode underscores the risks of buying hardware wallets from unofficial sellers on large marketplaces. Even when a platform hosts an official storefront, third-party sellers may still list devices that have been tampered with. Manufacturers are now facing pressure to do more to protect buyers and communicate threats promptly.
Where things stand
Ledger confirmed that one affected device contained an unauthorized implant and that losses may exceed $86 million, according to its public statements. The company continues to refer questions about its handling of earlier reports to those same statements.
Source
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.