Ledger’s $91 Million Blind Spot: When a “Genuine Check” Can’t Catch a Hidden Radio

(SeaPRwire) –

By: Ethan Gallagher

Mark Karpelès did exactly the thing hardware vendors hate. He named the problem in public, with dates, dollar figures, and a screenshot of his own correction. Ledger CEO Pascal Gauthier did exactly the thing executives do when the questions get uncomfortable. He attacked the messenger. “Coming from Mt Gox CEO… Come on man. You are no white knight. Get real.” That exchange on October 17 tells you more about trust in hardware wallets than any security whitepaper. Karpelès may carry the Mt. Gox scar, but his point is not about his past. He says a clearer warning could have prevented more than $90 million in losses. Gauthier says critics should separate proven facts from guesses. The problem is that the facts on the table already look bad enough.

Here are the agreed facts. Ledger published a security guide titled Best Practices To Securely Buy Your Ledger Signer. The site lists March 6, 2026 as the first publication date. The guide covers fake devices, wallet units with preset recovery phrases, and genuine devices altered after leaving the factory. It includes photos of modified circuit boards. The page was last updated on September 18. Without a saved copy of the March version, no one can prove when each photo or warning was added. Ledger has not said when it first learned about the affected CryptoBilis devices. Karpelès said Ledger received reports of spy hardware implants as early as December 2025. On October 9, Ledger asked CryptoBilis to pause sales and shipments. The attack itself is simple. Extra electronics inside a genuine Ledger sold through that reseller could capture the 24-word recovery phrase during setup and send it over a cellular connection. Ledger’s Genuine Check only confirms the Secure Element chip is authentic. It cannot spot added parts if the original chip is still in place. The Secure Element, the operating system, and the signing process were not compromised. The reseller link was.

The subtext cuts deeper. Gauthier leaned on Karpelès’ reputation instead of presenting a clear timeline. That matters because Ledger’s warning record is weaker than its defense. Karpelès even corrected himself, noting Ledger did publish an academy topic in March 2026 about the implant situation and recommended buying direct or from Authorized Resellers. The correction does not settle the central question. A warning that tells customers to buy from authorized resellers misses the point when the compromised device moved through a reseller. The reseller is exactly the layer that failed. Galaxy Research estimated about $91 million in suspected losses on October 16. Another report put losses above $100 million. Ledger has not confirmed a final total. Karpelès says similar implants appeared in other regions and he helped users check their devices. Ledger disputed European exposure after reviewing one case in Germany. Trezor and OneKey removed third-party resellers and tightened distribution checks. Ledger maintains the compromise is limited to Southeast Asia. Others disagree.

Here is the blunt truth. A hardware wallet is only as honest as every hand that touches it before the user. The Secure Element can be perfectly intact while a tiny cellular radio sits next to it. No end-user check catches that. No QR code confirms a sealed shipping chain. The real fix is not another blog post. It is a distribution model where resellers cannot open a box without leaving visible, hard-to-fake tamper evidence. Serialized seals, signed firmware provenance, direct-to-customer shipment, and supply chain audits must become the baseline. If vendors treat resellers as marketing partners instead of security boundaries, the next attack will be worse. Ledger told customers who bought from CryptoBilis in the last 90 days not to set up unused wallets. Those who already did should move funds to a new wallet on a trusted device. That is the only practical defense right now.

Author bio: Ethan Gallagher, a Silicon Valley hardware architect and infrastructure strategist focused on hardware supply chain security, trusted computing models, and hostile device modification cases.