A public row has broken out between Ledger CEO Pascal Gauthier and Mark Karpelès, the former head of collapsed exchange Mt. Gox, over what the hardware wallet maker knew about a spyware chip flaw before it was exploited in a string of thefts.
Karpelès alleges that Ledger was aware of dangerous spy chips months before the recent attacks and failed to adequately warn its users. He has said the losses tied to the scheme, which he puts at more than 90 million US dollars, could have been prevented had the company spoken up sooner.
The thefts stem from Ledger devices that criminals manipulated before they reached buyers, inserting a hidden additional circuit board into the hardware. According to the brief details, this chip intercepted the 24-word recovery phrase during wallet setup and transmitted it to attackers, effectively handing over full control of a victim's funds at the moment the device was configured.
Karpelès says he found one such chip himself, hidden behind the screen of a device he had opened from its original packaging. He points to a Ledger security guide dated 6 March 2026, which he says described manipulated devices and recommended buying only directly from Ledger or from authorised resellers.
He initially suggested the guide had shown images of industrially manufactured spy chips at the time, but later softened the claim. "Correction: I said @Ledger didn't talk about the implant situation at all despite knowing about it – they did publish an academy topic in March 2026 that talks about it and recommends buying direct or from Authorized Resellers," Karpelès wrote. The article in question was revised in September, which has left it unclear what the original March version actually contained.
Gauthier pushes back
Gauthier rejected the criticism in blunt terms, dismissing Karpelès's standing to make it given his role at Mt. Gox, the exchange that collapsed in 2014 after losing roughly 850,000 bitcoin. "That's coming from the CEO of Mt. Gox… Come on, man. You're no white knight. Get real…" he said.
Ledger has maintained that neither its operating system, nor its own servers or security chips were compromised in the recent attacks, placing the fault with third-party tampering of devices before purchase rather than with its own infrastructure. The company's Genuine Check tool verifies a device's original security chip but does not necessarily detect additional components fitted onto a device after manufacture, a limitation that leaves open the possibility of exactly the kind of implant described in this case.
For European buyers, the episode underscores a recurring supply-chain risk in hardware wallets: devices ordered through unofficial channels or intercepted before delivery can be altered in ways that standard authenticity checks may not catch.
