Ledger CEO Pascal Gauthier and former Mt. Gox chief Mark Karpelès clashed publicly over how well Ledger warned users about tampered wallets. Researchers estimate suspected losses above $90 million, though Ledger has not confirmed a final amount.
Ledger CEO Pascal Gauthier publicly clashed with Mark Karpelès on X on October 17 over warnings about modified hardware wallets. The devices are linked to an estimated $90 million in cryptocurrency thefts.
Karpelès questions Ledger's warnings
Karpelès questioned whether Ledger had communicated the danger of spying implants clearly enough before customers reported losses on devices sold through Southeast Asian reseller CryptoBilis. He then corrected an earlier claim, acknowledging that Ledger had published a security article in March.
However, he argued that guidance in an educational section was not enough. He said a more prominent warning could have prevented over $90 million in losses.
Gauthier responded that Ledger works extensively to protect customers, and he asked Karpelès to limit his comments to what he could substantiate. The exchange turned harsher when Gauthier cited Karpelès's past at Mt. Gox. Gauthier wrote: "You are no white knight. Get real"
What the March guide does and does not show
The article, titled Best Practices To Securely Buy Your Ledger Signer, lists March 6, 2026 as its original publication date and September 18 as its latest update. It describes attackers adding unauthorized components that can capture information shown during wallet setup.
Because of the September revision, the currently accessible version does not establish when each image or technical warning was added. The images therefore cannot independently prove what Ledger knew about the CryptoBilis attack at that time, according to the report.
Genuine Check cannot catch every implant
Ledger's Genuine Check verifies the cryptographic identity of the Secure Element, the protected chip that handles sensitive wallet operations. Ledger's security guide states the check cannot detect unauthorized physical additions when the original Secure Element remains intact.
Investigators found that the extra hardware could capture a 24-word recovery phrase during setup and send it over a cellular connection. Anyone holding the full phrase can potentially access the funds without the original device. Ledger said the discovery did not show that its Secure Element, operating system or transaction-signing process had been compromised.
Investigation and loss estimates
On October 9, Ledger asked CryptoBilis to suspend sales and shipments. It advised customers who bought from the reseller within the preceding 90 days not to initialize unused wallets.
Galaxy Research described approximately $91 million in suspected losses in its October 16 analysis. The report says that figure should not be treated as the amount conclusively stolen through every modified device.
Source: crypto.news
Trading involves risk.
Risk Disclaimer
