Ledger Was Warned of Tampered Devices as Early as 2025

Published: October 16, 2026 – 18:33 UTC

Ledger is facing questions over its handling of earlier hardware-wallet tampering reports after security researchers disclosed warnings dating back to December 2025, months before an October 9 incident involving stolen cryptocurrency and modified devices sold through an authorized reseller.Former Mt. Gox CEO Mark Karpelès said he knew of at least two people who had contacted the French hardware-wallet manufacturer about suspected implants. The disclosures raise questions about whether earlier incidents could have prompted stronger customer warnings or additional checks across Ledger's distribution network.The controversy follows suspected cryptocurrency losses exceeding $86 million, according to independent blockchain investigators. Ledger has confirmed unauthorized hardware inside an affected device but has not established a final loss figure or the total number of compromised wallets.

When Did Ledger First Receive Hardware Implant Warnings?

Security researcher Joe Grand said he notified Ledger on March 4, 2026, about a malicious implant discovered in a Ledger Nano X purchased through Thailand's Lazada marketplace in August 2025.Grand said Ledger acknowledged the findings and indicated that an internal investigation was underway. However, he questioned why the manufacturer had not proactively warned customers about the potential threat.Grand's technical research was also documented in a public presentation, revised in May 2026, examining a real-world hardware implant inside a Nano X.Separately, Karpelès identified Vietnamese cryptocurrency educator Tai Zen as having contacted Ledger about suspected device tampering in December 2025.The earlier cases have not been established as part of the same operation behind the October thefts. Nevertheless, they indicate that physical modification techniques were being reported before the current investigation became public.Ledger has not publicly detailed its handling of Grand's March disclosure or explained whether those earlier reports influenced its subsequent security procedures.

Investor Takeaway

The central issue is not simply whether Ledger received isolated warnings, but whether its disclosure and escalation procedures were adequate. A documented timeline of earlier investigations would help customers and institutional counterparties assess the company's response.

How Did the Hardware Implants Compromise Wallet Security?

Ledger's Donjon security team established that the implant found during the CryptoBilis investigation could monitor information displayed during wallet initialization, reconstruct the user's 24-word recovery phrase and transmit it through an LTE connection using an embedded SIM.The attack did not require compromising Ledger's Secure Element, operating system or transaction-signing process. Instead, additional electronics intercepted sensitive information elsewhere inside the device.Once attackers obtained a recovery phrase, they could recreate the wallet independently and transfer its cryptocurrency without retaining physical access to the original device.That mechanism creates an important distinction between authentic hardware and trustworthy hardware. A genuine cryptographic chip does not necessarily establish that the surrounding electronics have remained untouched.As FinanceFeeds explained in its examination of the CryptoBilis incident, Ledger's Genuine Check can authenticate the Secure Element without necessarily detecting unauthorized physical additions.Independent loss estimates have varied considerably. Some researchers identified suspected losses above $86 million, while subsequent blockchain analysis suggested approximately $93 million. These estimates are not confirmed company figures and may reflect different transaction sets.

Why Are Authorized Resellers Becoming a Security Concern?

Grand's earlier device was purchased through a marketplace seller identified as LedgerXXX, which does not currently appear in Ledger's authorized-reseller directory for Thailand. Its authorization status at the time of purchase remains unclear.The CryptoBilis incident presents a different problem because the reseller operated within Ledger's authorized distribution network in Southeast Asia.Ledger subsequently expanded its sales suspension across six Southeast Asian countries and Hong Kong while examining possible distribution vulnerabilities.Concerns also reached Europe, where MediaMarktSaturn temporarily withdrew Ledger products following reports of modified devices in Germany. Ledger has not confirmed financial losses associated with those German reports.The problem is not necessarily confined to one manufacturer. Grand also identified modified Trezor devices obtained through unauthorized sellers, while competing manufacturer OneKey has reviewed its reseller listings and verification arrangements.

Investor Takeaway

Authorized distribution reduces some purchasing risks but does not eliminate exposure to physical tampering. For custody providers and larger cryptocurrency holders, documented device provenance and controls over returned inventory are increasingly relevant to operational security.

What Has Ledger Changed Following the Incident?

In an October 15 statement, Ledger characterized the incident as a localized distribution attack rather than a compromise of its manufacturing systems, operating software or internal infrastructure.The company said its investigation involved examining devices from retail locations and warehouses, including samples collected in Germany. Those inspections did not identify compromised units among the samples examined.Ledger also announced tighter distribution requirements. Authorized sellers must not return previously sold devices to inventory, even when packaging appears unopened. Products should be stored away from public shelves and handed to customers at purchase.Resellers must also promptly report unusual product complaints. Ledger said it is working with law enforcement and security researchers to trace stolen funds and investigate the attack infrastructure.These measures address potential opportunities for tampering but do not resolve how the modified devices entered circulation or why earlier warnings did not result in a more visible response.For users who initialized a potentially compromised device, simply replacing the physical wallet is insufficient if the original recovery phrase has been exposed. Ledger has advised affected CryptoBilis customers to consider migrating assets to a new device with a newly generated recovery phrase.

Investor Takeaway

Ledger's next challenge is establishing the scale and origin of the tampering while demonstrating that its revised distribution controls can prevent recurrence. The investigation could also influence how institutional custody operations evaluate hardware-wallet suppliers and their security-disclosure practices.

Source: FinanceFeeds