Former Mt. Gox CEO Mark Karpeles reported finding a malicious circuit board inside a factory-sealed Ledger hardware wallet. The device, which originated from a seller in Malaysia, contained a hidden antenna and a SIM card module designed to transmit recovery phrases remotely.
The implant was positioned behind the screen in an area typically reserved for padding. Karpeles noted that the device arrived with intact shrink wrap, making the physical tampering difficult to identify upon initial inspection.
Ledger confirmed that its internal security verification process validates the authenticity of the security chip but cannot detect all physical modifications. The company has advised users to follow official security guidelines to verify their hardware.
Ledger has requested that the Malaysian reseller CryptoBilis cease all sales and shipments of its products. This follows reports of drained wallets, with on-chain analysis from Bitquery estimating losses of $92.9 million across 311 wallets, including one instance involving 80 Bitcoin.
While Ledger is investigating the situation, the company has not yet confirmed the total financial losses or established a direct link between the tampered hardware and the incidents involving CryptoBilis. Ledger continues to urge customers to purchase devices only through authorized channels.
