Ledger Supply-Chain Implant Scandal Widens to Flex Model, Beyond Asia

A supply-chain attack targeting Ledger hardware wallets, which the company had attributed to a single compromised reseller in Southeast Asia, appears to extend further than previously acknowledged. Former Mt. Gox CEO Mark Karpelès confirmed via X that a Ledger Flex device he inspected contained a spy implant, and a separate researcher has reported finding an added communication chip inside another Flex unit.

The device Karpelès examined was purchased at the Metapod retail store located in Singapore's airport, not from CryptoBilis, the reseller Ledger had identified as the source of the compromised units. It was sent to Karpelès for inspection by a user named Ben Yorke, who had bought it during the northern hemisphere summer for 300 US dollars. Yorke told Karpelès he had noticed suspicious marks and scratches on the device casing and, for that reason, never connected or configured the wallet.

Separately, a researcher identified on X as 大方BigFang reported on October 12, 2026, receiving information about another physically altered Ledger Flex unit. When opened, the device revealed the addition of a communication chip not present in genuine units, though the researcher said the exact function of the component still needs technical verification.

Ledger's narrower account

Ledger's security team, Ledger Donjon, is investigating the presence of unauthorized hardware implants, but the company's public communication has limited the incident to units sold by CryptoBilis, stating that all confirmed fund losses to date are linked exclusively to that reseller. Karpelès responded directly to Ledger's corporate account, stating that the compromised Flex device did not come from CryptoBilis but from the Metapod store in Singapore.

The company's account has also omitted a case reported in Europe. A user there found a version of the same spy component in a wallet purchased at a physical MediaMarkt store branch, according to the brief underlying this reporting. Ledger's investigation has so far focused on Asia, leaving the European case unaddressed in its official statements.

How the implant works

According to the described attack mechanism, perpetrators insert a microcontroller inside the device that reads the 24-word recovery phrase as it is displayed on screen during initial setup. The microcontroller then transmits that information via its own cellular connection, independent of the user's network. Because the method intercepts the recovery phrase visually at the point of display, it extracts credentials without breaching the device's original security chip or its internal software, making the tampering difficult to detect through standard verification of the wallet's firmware.

For European buyers, the discovery of an implant tied to a mainstream electronics retailer such as MediaMarkt, rather than a specialised reseller, raises the stakes of the episode considerably. Until Ledger issues a fuller accounting that addresses the Flex model and the European case directly, customers who purchased devices through retail channels outside the company's own online store may have no reliable way of knowing whether their unit has been tampered with.