Ledger Supply Chain Breach Widens as Spy Implants Surface in Devices From Two More Resellers

Mark Karpelès, CEO of Karpelès Lab, has found hardware implants embedded in Ledger devices sourced from two additional authorized resellers, escalating what is already one of the most serious supply chain security incidents in crypto hardware history.

The implants turned up in both the Ledger Flex and the Ledger Nano X, two of the company's most widely used cold-storage devices. More alarming than the breadth of the discovery is what Karpelès says about the implants themselves: the newest version appears engineered for mass production, implying a deliberate, scalable operation rather than opportunistic one-off tampering.

Ledger's response has been measured but raises its own concerns. The company says German stock inspections found no tampering in the devices examined, and it has not verified any wallet drain definitively tied to a device purchased outside Southeast Asia. The critical caveat, confirmed in Ledger's own statement, is that its standard authenticity verification system cannot detect the added hardware. That means users who ran Ledger's built-in checks and received a clean result may still be holding a compromised device.

"Ledger says German stock inspections found no tampering and it has not verified a drain tied to a device bought outside Southeast Asia. Its authenticity check cannot detect the added hardware."

Ledger, statement

The gap between "no tampering found in Germany" and "our verification tool cannot detect this type of tampering" is not a minor technical footnote. It is the central problem. Ledger's authenticity check is the primary assurance mechanism the company offers consumers. If that mechanism is blind to soldered implants, the inspection results carry far less weight than they appear to.

Ledger has not confirmed how many devices may be affected across all reseller channels, nor has it publicly identified which resellers are involved beyond the Southeast Asia region initially flagged in earlier reports. The extension of confirmed implant discoveries to a second and third authorized reseller suggests the compromise is not contained to a single distribution node.

Mark Karpelès brings significant technical credibility to this disclosure. As the former CEO of Mt. Gox, the exchange that collapsed in 2014 after losing approximately 850,000 bitcoin, he is a polarizing figure in the industry. His technical expertise in hardware security analysis stands independently of that history, but it is context any reader will hold. His findings, if independently verified, represent a serious escalation regardless of who is reporting them.

Supply chain attacks on crypto hardware are not new. The broader security community has documented tampered devices reaching end users through gray-market and third-party channels for years. What distinguishes this incident is the involvement of authorized resellers, not counterfeit or gray-market operators. That distinction matters because it removes one of the standard mitigations: buying only from official channels. If authorized resellers are the vector, the standard advice fails.

For users holding funds on Ledger devices, the practical situation is difficult. Ledger's own tool cannot confirm safety. The company's geographic framing, centering risk on devices purchased outside Southeast Asia, offers limited reassurance given that implants have now surfaced across multiple reseller networks in what appears to be a widening pattern. Users with significant holdings on any Ledger device purchased through a reseller, rather than directly from Ledger, face a verification gap the company has not yet closed.

Ledger has not announced a hardware recall or a replacement program as of this writing. The company's position, that no verified drain has been linked to implanted devices outside the initially identified region, may shift as independent researchers examine more units. Karpelès has indicated his lab will continue testing devices from additional sources.