TLDR:
Ledger wallet theft estimates vary: Galaxy Research counted 91 million dollars across five networks, while trackers including BNB Chain put the total at 93 million to 95 million dollars; Ledger has not confirmed its own figure.
Karpelès cited Ledger’s March guide, but the current page lists a September update and does not reveal when specific warnings or tampering images were added.
Ledger’s Genuine Check verifies the Secure Element, yet its documentation says it may not detect added hardware if the original security chip remains intact.
On October 9, Ledger asked CryptoBilis to pause sales and shipments. It told recent buyers not to initialize unused wallets and advised those who had set them up to transfer assets to a wallet with a fresh recovery phrase.
The Ledger wallet theft dispute escalated publicly on October 17. Ledger CEO Pascal Gauthier challenged former Mt. Gox chief Mark Karpelès over warnings about modified hardware wallets. The exchange followed reports of losses involving devices sold through CryptoBilis, a Southeast Asian reseller. Investigators found unauthorized electronics inside at least one device, reportedly designed to capture recovery phrases during setup.
Karpelès said Ledger had discussed tampering in a March security guide, but questioned whether customers received a clear warning. Gauthier defended the company’s work and urged him to distinguish evidence from speculation. That puts Ledger wallet theft estimates and warnings under scrutiny.
Ledger Wallet Theft Dispute Puts Earlier Warnings Under Scrutiny
Karpelès corrected his earlier claim that Ledger had never discussed physical implants. He cited “Best Practices To Securely Buy Your Ledger Signer”, first published March 6, 2026. Ledger lists September 18 as its latest update .
Correction: I said @Ledger didn’t talk about the implant situation at all despite knowing about it – they did publish an academy topic in March 2026 that talks about it and recommends buying direct or from Authorized Resellers. https://t.co/UUNH1H2L3D pic.twitter.com/UNrxyLnsmd
— Mark Karpelès (@MagicalTux) October 17, 2026
The guide covers counterfeit wallets, preset recovery phrases, and genuine devices modified after leaving the factory. It says added components may collect information shown during setup. The current page includes images of altered circuit boards.
Karpelès argued the examples showed Ledger knew about sophisticated implants before customers reported CryptoBilis devices. He said a prominent warning could have prevented losses above 90 million dollars, but that claim remains unproven.
Because Ledger updated the page in September, it does not show when each image or warning appeared. The current record alone cannot establish what Ledger knew about specific CryptoBilis devices in March.
Mt. Gox collapsed in 2014 after major Bitcoin losses, leaving creditors in a long recovery process. Gauthier invoked that failure; Karpelès said it shaped his security expectations. Their exchange yielded no new evidence about who modified devices or when.
CryptoBilis Investigation Shows the Limits of Device Authentication
Ledger’s Genuine Check verifies the Secure Element, a chip that handles sensitive wallet operations. During setup, official software requests a response signed with the chip’s manufacturing identity.
It confirms the chip is authentic, but cannot inspect every component. Ledger says added hardware may go undetected when the original chip remains intact.
That limitation matters in the Ledger wallet theft investigation. Investigators reportedly found an implant near a CryptoBilis device screen. It could capture the 24-word phrase shown during setup while leaving the original chip and security functions in place.
Anyone with a complete recovery phrase may access associated funds without the original device. The implant reportedly sent captured words through a cellular connection.
Ledger said the discovery did not show compromise of its chip, operating system, or transaction signing. The Ledger wallet theft case involved physical interference during distribution, exposing a gap between chip authentication and device integrity.
Ledger opened an investigation after customer complaints. On October 9, it asked CryptoBilis to pause sales and shipments. Ledger told customers who bought devices in the prior 90 days not to initialize unused wallets. Ledger advised customers who had initialized devices to move assets to a new wallet with a fresh recovery phrase.
Galaxy Research’s Ledger wallet theft estimate was 91 million dollars across five networks on October 16. Trackers that included BNB Chain put the figure at 93 million to 95 million. Ledger has not confirmed its total. The gap likely reflects scope. Neither the on-chain counts nor the guide establishes how much a warning could have prevented.
Ledger’s guidance says authorized sales and a passing check cannot prove nobody physically modified a wallet. Buyers should inspect devices and complete authentication through official software before setup begins.
Ledger advises buyers to purchase directly from the company or its authorized sellers. Authorized resellers cannot return devices to inventory for resale. A tampered wallet report in Germany prompted retailers to review distribution practices as the broader inquiry continues.
The post Ledger CEO and Mt. Gox Boss Clash Over Wallet Theft Warnings appeared first on Blockonomi .
