Former Mt. Gox chief Mark Karpelès revealed that he knew of two separate contacts who warned Ledger about altered hardware as early as December 2025. One of those contacts, Vietnamese educator Tai Zen, reported a suspected implant in a Ledger device purchased that month. A separate disclosure came from security researcher Joe Grand, who on March 4 2026 informed Ledger of a malicious component found in a Nano X bought through the Thai marketplace Lazada in August 2025. Grand said Ledger acknowledged the finding internally but did not issue a customer advisory.
Ledger’s handling of the disclosures
Ledger declined to comment directly on Grand’s report and redirected inquiries to its public statements on X. Karpelès criticized the company for treating a single incident as “normal” and argued that the growing volume and sophistication of the implants should have triggered broader warnings. The reseller involved, listed as “LedgerXXX” on Lazada, was not an authorized Ledger partner in Thailand, even though the marketplace hosts an official Ledger storefront. This ambiguity makes it difficult for buyers to differentiate legitimate sellers from third-party listings.
Marketplace challenges and industry response
OneKey, another hardware wallet maker, noted that platforms such as Lazada host many independent vendors, creating verification gaps for consumers. In reaction to the recent events, OneKey suspended its own reseller listings pending stricter vetting processes, urging manufacturers to assume greater responsibility for safeguarding users.
Trezor faced similar issues. In August 2026, Grand alerted the company about tampered Trezor One and Model T devices obtained from unauthorized sellers on TikTok and Facebook. Trezor reminded the public that counterfeit hardware occasionally appears on unofficial channels, a problem it first warned about in 2022 concerning Russian marketplaces. While the firm maintains that new wallets sold through authorized distributors show no compromise, it treats reports from unauthorized sources as early warnings and uses them to tighten security.
Why it matters
The Ledger episode underscores a systemic vulnerability in the hardware wallet ecosystem: reliance on third-party marketplaces can expose users to compromised devices, and manufacturers may be hesitant to issue broad advisories until a breach is confirmed through official channels. As crypto assets continue to be stored on physical devices, the lack of transparent communication can erode trust and increase the likelihood of large-scale losses, as illustrated by the reported $4.8 million theft linked to tampered Ledgers in Asia. Strengthening reseller verification, improving incident reporting mechanisms, and delivering timely public warnings are essential steps to protect investors and preserve confidence in hardware wallet solutions.
