In a fiery exchange on X, Ledger CEO Pascal Gauthier and former Mt. Gox chief Mark Karpelès engaged in a public dispute concerning the security of hardware wallets, particularly focusing on warnings about potential tampering linked to an alarming estimated $90 million in crypto thefts.
The debate erupted on October 17, with Karpelès questioning Ledger’s communications regarding the presence of spying implants in their hardware wallets. He argued that more explicit warnings from Ledger could have mitigated significant financial losses, suggesting that the company was aware of risks as early as December 2025.
In defense, Gauthier emphasized Ledger’s commitment to security, urging critics to differentiate between verified information and speculation. “Coming from Mt. Gox CEO… Come on man. You are no white knight. Get real,” Gauthier retorted, referencing Karpelès’s controversial past with the now-defunct exchange that collapsed in 2014 after losing a massive amount of Bitcoin.
Karpelès’s assertion is backed by Galaxy Research, which estimated around $91 million in losses due to the compromised wallets. However, Ledger has not confirmed a final figure, as varying reports suggest losses might exceed $100 million. The company has indicated that the attack appears concentrated in Southeast Asia, a claim that other observers have challenged, suggesting broader implications.
Ledger’s Security Guide and Controversy
During the exchange, Karpelès highlighted a security guide published by Ledger, titled “Best Practices To Securely Buy Your Ledger Signer,” which first appeared on March 6, 2026. This guide addresses issues such as counterfeit devices and wallets with manipulated recovery phrases, including images of modified circuit boards.
However, the timeline surrounding the guide’s updates remains unclear, as the most recent version was modified on September 18, without a saved copy of the March edition to clarify when critical warnings were included.
Investigations revealed that genuine Ledger devices sold through CryptoBilis, a Southeast Asian reseller, were tampered with, containing extra electronics capable of capturing a user’s 24-word recovery phrase during setup, transmitting it via cellular networks. This discovery raised serious concerns about the efficacy of Ledger’s Genuine Check, which, according to the company, only verifies the authenticity of the Secure Element chip without detecting any additional components.
In response to these alarming findings, Ledger requested that CryptoBilis halt sales and shipments on October 9. Following this, they advised customers who purchased devices from the reseller in the last 90 days to refrain from setting up their wallets, instructing those who had already done so to transfer their funds to a secure device.
Karpelès has also suggested that similar tampering incidents may have occurred beyond Southeast Asia, asserting that he has assisted users in verifying their devices. Ledger, however, has disputed claims of European exposure, following a review of a case in Germany.
As the fallout continues, competitors like Trezor and OneKey have responded by tightening their distribution channels and eliminating third-party resellers to bolster security. The ongoing debate underscores the critical importance of transparent communication in safeguarding assets in an increasingly perilous digital landscape.
