Ledger CEO and Mark Karpelès clash over implant warnings

Ledger CEO Pascal Gauthier and former Mt. Gox chief Mark Karpelès traded blows on X over whether the wallet maker warned customers early enough about hidden implants in resold devices. Karpelès argues that clearer alerts could have prevented more than $90 million in losses; Gauthier answered by bringing up Mt. Gox, BeInCrypto reported.

What was said

• The correction: on 17 October Karpelès, who helped expose the attack after finding an extra circuit board inside a sealed Ledger device, acknowledged that Ledger had published a Ledger Academy article on implants in March 2026, advising buyers to purchase direct or from authorised resellers.
• The charge: he said a single article "buried" in the academy was not enough, arguing that the March piece already pictured both hand-made and mass-produced implants — in his words, "a five-alarm fire in the making." BeInCrypto notes the article was updated in September, so it is unclear when those images first appeared.
• The reply: Gauthier said Karpelès did not know everything and that Ledger goes "above and beyond" for customers, then added: "Coming from Mt Gox CEO… Come on man. You are no white knight." Mt. Gox collapsed in 2014 after roughly 850,000 bitcoin went missing.
• The rebuttal: Karpelès said that history was exactly why he expected Ledger "to be better than me," and criticised the company for still calling it "the CryptoBilis incident" while similar implants have surfaced elsewhere.

Our take

The personal jab is a distraction. The implant reads the 24-word recovery phrase during setup and sends it out over a mobile connection, and the device's own authenticity check reportedly still passed on tampered units — so the only real defence is knowing where your hardware came from. That makes timely, prominent warnings the product, not an afterthought. Ledger has since halted sales through CryptoBilis, and rivals have reacted too: Trezor trimmed its reseller network. The latest reports of implants at two more resellers suggest the supply-chain problem is wider than one shop.

For holders, the practical lessons are unchanged: buy directly from the manufacturer, treat any device that arrives pre-configured or with a printed seed as compromised, and never type a recovery phrase into anything other than the wallet itself. Our guide to how a hardware wallet works explains why the seed phrase is the crown jewel.