French hardware wallet manufacturer Ledger was alerted to tampered devices months before its recent security incident came to light, according to former Mt. Gox CEO Mark Karpelès. Karpelès told Cointelegraph he learned of at least two separate reports from users who received Ledger products with unauthorized hardware implants, with the earliest dating to December 2025.

Security researcher Joe Grand confirmed he contacted Ledger on March 4, 2026, after discovering a malicious implant in a Nano X wallet purchased via Lazada Thailand in August 2025. Grand said Ledger acknowledged the report internally but did not issue any public warning to customers. Vietnamese crypto educator Tai Zen also reported a suspected implant to Ledger in December 2025, as cited by Karpelès.

The situation gained broader attention on October 9, when Ledger confirmed that a wallet sold through CryptoBilis, an authorized Southeast Asian reseller, contained an unauthorized component. The company has not disclosed details about how the implant was introduced or whether other affected devices remain in circulation.

Grand’s investigation revealed the tampered device was listed under the seller name "LedgerXXX" on Lazada, which was not designated as an authorized reseller at the time of purchase. Cointelegraph attempted to verify the seller’s status and the company’s internal response but received no direct comment from Ledger. The firm instead referred inquiries to its public statements on X, where it has previously described the matter as isolated.

Karpelès noted that the volume and sophistication of reported incidents should have prompted a proactive customer alert. "The increasing number of reports they must have received, and the increasing quality/technology used should have alerted them enough to act," he said. "At minimum, they could have reminded users to remain vigilant."

The issue extends beyond Ledger. In August 2026, Grand also reported tampered Trezor One and Model T wallets purchased through unauthorized sellers on TikTok and Facebook. Trezor acknowledged that counterfeit devices occasionally appear via third-party channels, though it maintains that recent claims of no compromised new wallets apply only to authorized distribution.

Trezor stated that reports from unofficial sources serve as early warnings and inform its security protocols. "What changes the picture is a new technique, or a first case coming through an authorised channel," the company said. "Either one means the problem has moved closer to ordinary buyers, and that’s when we’d move fastest, including warning customers directly."

Industry analysts have pointed to marketplace verification gaps as a systemic risk. OneKey, a hardware wallet competitor, removed its reseller listings in late 2026 pending enhanced verification processes, citing the need for manufacturers to assume greater responsibility for supply chain security.

The incident underscores ongoing challenges in securing hardware wallet supply chains, particularly as bad actors exploit gaps in reseller verification and marketplace oversight. While Ledger has not confirmed plans for customer notifications or broader supply chain reforms, the episode has prompted renewed scrutiny of third-party sales channels across the sector.