By Elena Vasquez

Former Mt. Gox chief executive Mark Karpelès reports that Ledger received at least two written warnings about tampered hardware wallets beginning in December 2025, months before a security crisis surfaced on October 9, 2026.

The warnings reached Ledger five to ten months before wallets distributed through authorized Southeast Asian reseller CryptoBilis produced user losses, according to Karpelès. The timeline implies Ledger held actionable intelligence through the spring and summer sales cycle without alerting buyers.

"Maybe Ledger not responding to a single event of an implant found on a Ledger purchased from a shady dealer is normal," Karpelès told Cointelegraph. He added: "However the increasing number of reports they must have received, and the increasing quality/technology used should have alerted them enough to act, and at least remind customers to be careful."

The cumulative silence suggests Ledger weighed disclosure costs against reputational risk and chose restraint.

What did Joe Grand disclose?

Security researcher Joe Grand alerted Ledger on March 4, 2026, about a malicious implant inside a Nano X unit purchased through Lazada Thailand in August 2025. Grand told Cointelegraph that Ledger acknowledged his findings and said it was investigating internally, but he criticized the company for not issuing a proactive customer warning.

Grand identified the seller as "LedgerXXX" on Lazada. At publication, LedgerXXX was not listed as an authorized reseller in Thailand, although Lazada's official Ledger storefront was. Cointelegraph sought clarification from Grand and Ledger on whether the unit passed through an authorized supply chain before reaching the marketplace listing.

A March acknowledgment without a public advisory left retail buyers exposed through the summer sales cycle.

What is the warning timeline?

Vietnamese crypto educator Tai Zen contacted Ledger about a suspected hardware wallet implant in December 2025, per Karpelès. Grand's disclosure followed on March 4, 2026, about a separate device bought seven months earlier.

Karpelès told Cointelegraph he was aware of at least two people who flagged tampered units and said he had not seen any public warning from Ledger in response. Ledger declined to comment on its handling of Grand's disclosure and referred Cointelegraph to its public statements on X.

The pattern points to a structural disclosure gap between researcher contact and customer notification.

How did the October crisis emerge?

Ledger confirmed that one affected device contained an unauthorized implant when the security episode surfaced on October 9, 2026. CryptoBilis operates as an authorized reseller across Southeast Asia, which differs from the Lazada case where LedgerXXX was unauthorized.

The distinction matters because authorized resellers carry warranty and supply-chain protections that marketplace sellers typically do not. OneKey head of sales Archie told Cointelegraph that Lazada hosts numerous independent sellers, complicating customer verification of authorized storefronts.

Following the recent incidents, OneKey removed its reseller listings pending stricter checks and argued that manufacturers bear primary responsibility for protecting customers. The authorized-reseller link in the October case shifts the failure from marketplace hygiene to vendor due diligence.

Does Trezor face similar exposure?

Grand's findings extended beyond Ledger. In August 2026, he alerted Trezor about tampered Trezor One and Model T wallets purchased from unauthorized TikTok and Facebook sellers. Trezor told Cointelegraph that counterfeit wallets occasionally appear through unauthorized sellers, a pattern it had warned about on Russian marketplaces in 2022.

The hardware maker clarified that its recent statement of no evidence of compromised devices applied only to new wallets sold through authorized resellers. "What changes the picture is a new technique, or a first case coming through an authorised channel," Trezor said. "Either one means the problem has moved closer to ordinary buyers, and that's when we'd move fastest, including warning customers directly."

Trezor's stated protocol treats any first authorized-channel case as a trigger, which Ledger has yet to articulate on the record.

What enforcement or structural change is next?

Trezor has reduced its reseller base as a preventative step, citing the Ledger tampering reports as a market signal. Ledger has not announced a comparable reseller contraction. Grand's presentation identifies a specific Lazada seller, giving investigators a concrete starting point for tracing the supply chain back to the implant's point of origin.

The unresolved question is whether Ledger will adopt a public-warning protocol once a researcher or educator flags tampered devices, independent of whether a loss event has been confirmed. Without such a protocol, the next disclosure may again reach Ledger months before the public learns of it.