Ledger CEO and Mark Karpelès Clash Over $90M Hardware Wallet Security Scandal

Ledger CEO Pascal Gauthier and former Mt. Gox chief Mark Karpelès have engaged in a heated online dispute over supply chain security standards following hardware wallet implant attacks that led to more than $90 million in user losses. ## Dissecting the $90M Hardware Implant Allegations Karpelès exposed the security threat after opening a sealed Ledger device and discovering a hidden circuit board engineered to capture a user's 24-word recovery phrase and transmit it to cybercriminals. He alleged that Ledger was aware of sophisticated hardware implants as early as March 6, referencing an academy security guide published by the company that illustrated both mass-produced and handmade spy chips. Although the guide was updated in September, Ledger acknowledged that its proprietary Genuine Check verification tool is unable to detect internal physical modifications if the authentic security chip remains intact. Karpelès initially asserted that Ledger failed to inform users about the threat, but later corrected his statement, noting that the March guide did advise purchasing devices directly or via Authorized Resellers. Nevertheless, he maintained that clearer and more aggressive public warnings could have prevented the substantial losses. Hardware security risks remain a critical vulnerability in self-custody setups, similar to incidents where users lost funds in a Ledger hardware wallet attack. ## Personal Clash and Industry Reseller Retraction Responding to the criticism, Gauthier defended Ledger's communication before turning the argument personal, telling Karpelès he is "no white knight" and urging him to "get real." Gauthier referenced the catastrophic 2014 collapse of Mt. Gox, where approximately 850,000 Bitcoin vanished under Karpelès' leadership. Karpelès countered that his past experience leading an exchange during a crisis is precisely why he expects higher security and transparency standards from hardware providers. In the wake of breach reports, Ledger halted sales through reseller CryptoBilis, while reports of tampered devices across Europe have exacerbated industry concerns. Competitor Trezor has also taken steps to reduce its third-party reseller network to mitigate supply chain risks. Key Takeaways: - Mark Karpelès discovered a hidden spy circuit board inside a sealed Ledger wallet designed to steal 24-word recovery phrases. - Over $90 million in user losses have been linked to hardware wallet implants. - Ledger's Genuine Check cannot detect physical implants if the original security chip is intact. - Pascal Gauthier cited the missing 850,000 Bitcoin from Mt. Gox in 2014 during the feud. - Ledger suspended reseller CryptoBilis, while Trezor is trimming its reseller network. ## Why It Matters This public dispute highlights critical vulnerabilities within offline crypto cold storage that extend beyond software encryption to physical supply chain logistics. Even authentic, sealed hardware wallets can be intercepted and modified before reaching consumers without triggering automated validation tools like Genuine Check. As retail and institutional investors increasingly rely on self-custody solutions, hardware manufacturers will face mounting pressure to secure direct-to-consumer delivery pipelines and eliminate reliance on third-party resellers.