A public dispute has emerged over whether Ledger’s security checks can detect the hardware “spying implants” found in devices linked to recent cryptocurrency thefts. On October 19, former Mt. Gox CEO Mark Karpelès accused Ledger of “misleading advertising,” pointing to an apparent contradiction between a statement from the company’s Support account in August and its published technical documentation.
The discrepancy concerns what Ledger’s Genuine Check actually verifies. Ledger’s documentation says the check authenticates the Secure Element, a security chip inside the device, but cannot detect every unauthorized physical modification around it. The Crypto Times reviewed Ledger’s published guidance, which explicitly names spying implants as an example of a modification the check may not catch. That limitation is documented by Ledger itself; whether the August support reply amounts to misleading advertising, as Karpelès alleges, remains a disputed characterization rather than an established legal finding.
What Ledger Support Said, and What Ledger’s Documentation Says
The exchange Karpelès highlighted dates to August 20, 2026. Responding to a user, Tai Zen (@HeyTaiZen), who urged the company to add tamper-evident seals because hackers could install additional hardware inside devices, Ledger’s official Support account on X replied that a sticker was unnecessary because Ledger uses “Cryptographic Attestation.” The reply said the Secure Element was designed to detect physical tampering and would refuse to execute unsigned code or pass the Genuine Check if additional hardware attempted to intercept signals, and it argued that a cryptographic proof performed by the chip was more secure than a physical sticker.
Ledger’s published documentation sets out a narrower scope. Its Academy guide to securely buying a Ledger device says the Genuine Check is designed to protect against counterfeit devices, then states that the check “cannot detect unauthorized physical modifications to the hardware, such as spying implants, if the original Secure Element remains intact.” The same guide says the check cannot verify a device’s physical supply-chain history, and Ledger’s own security documentation repeats that limitation.
The distinction is between authenticating the Secure Element and verifying every component in the complete device. By Ledger’s own account, the Genuine Check can establish that the chip is genuine, but it does not guarantee that no unauthorized hardware has been added elsewhere in the device. Karpelès argued that the August reply contradicted this documented limitation, questioning how the statement could avoid being considered misleading advertising; he also said he had archived the exchange. Ledger’s published documentation confirms the stated limitation, but that alone does not establish the intent behind a separate support-account reply.
The Engineers’ Point: The Chip Does Not Know What Board It Is On
Karpelès was joined by Dave Jones, the electronics engineer behind the EEVblog channel, who argued that a Secure Element could be removed from one circuit board and soldered onto another without losing its cryptographic identity. Karpelès made a similar point while sharing an image of a breadboard setup, arguing that a genuine chip could still pass a Genuine Check when installed in a modified assembly.
The technical argument is that a successful cryptographic check of one component does not, by itself, certify the integrity of every component surrounding it. If the original Secure Element remains intact, additional hardware elsewhere in the device may fall outside what the Genuine Check verifies — a point consistent with Ledger’s own documentation. The documented limitation does not mean that every modified device will pass every security test, or that every reported implant is genuine; it means the Genuine Check should not be treated as a comprehensive physical inspection of a device.
The Warnings Ledger Received
Critics on social media argue that Ledger had prior notice of the risk of hardware tampering. Tai Zen’s August post raised the possibility of additional components being installed inside devices, and he said he had previously flagged the issue to Ledger’s Donjon security team. Separately, researcher Joe Grand reported finding a malicious implant in a Ledger Nano X purchased through Lazada Thailand in August 2025. Ledger’s own later documentation acknowledges the general risk of unauthorized hardware modifications, though that does not independently establish the details of every reported device.
Karpelès has also documented reports of suspicious hardware in a public catalog. The Crypto Times reported on that catalog on October 15, when it listed 15 reported devices associated with nine sellers; those entries are reports collected in a public catalog, not a count of devices independently confirmed as compromised by Ledger. His broader argument is that the risk was not purely hypothetical, since Ledger had already published guidance acknowledging that genuine devices could be physically modified after leaving the factory. That history provides context for his criticism, but does not establish that Ledger’s August reply was intended to mislead customers.
What the Check Actually Protects
There is a technical defense available to Ledger, and it matters for fairness. Cryptographic attestation was designed to defeat counterfeits and to prove a device contains a genuine, unaltered Secure Element — the chip that guards the private keys. By Ledger’s own account of the recent attacks, that chip was not broken: the company’s Donjon team found that the implants in tampered devices did not defeat the Secure Element, its operating system or its signatures, but instead captured the user’s 24-word recovery phrase as it was displayed on screen during setup, exfiltrating it over an added radio link. On that reading, the implant never needed to pass itself off as the chip; it simply eavesdropped on the human-readable secret — a class of physical attack the Genuine Check was never built to detect, and which, as the documentation says, it does not.
That is precisely why the wording of the August Support reply is contested rather than clear-cut. The statement came from Ledger’s customer-support account in a reply to a user, not from a formal advertisement or spec sheet, and it arguably compressed and overstated a nuance the company spells out in its documentation. Ledger has continued to point users to cryptographic attestation as a genuine protection against counterfeit devices, which it is. The company has not issued a formal response to the “misleading advertising” allegation.
The Money, and What Is Confirmed
The total losses associated with the recent thefts remain unconfirmed by Ledger. Karpelès referred to more than $90 million stolen, while third-party estimates have placed the losses at more than $86 million and higher. These are external estimates, not a final figure confirmed by Ledger. In its official response to the attack, Ledger described the incident as a localized distribution-channel attack and said its chip, operating system and servers were not compromised; it has not published a definitive count of affected users or a verified aggregate value for the stolen funds.
The timeline Ledger has disclosed includes its October 9 notice that it was investigating reports of losses involving devices sold through CryptoBilis, followed by its October 10 confirmation that one affected user’s device contained an unauthorized hardware implant. On October 13, Ledger Donjon described how the implant could capture recovery phrases displayed during setup, and the company’s October 15 incident-response guidance set out its account of the attack and the precautions it recommends. Ledger has advised customers who bought devices through CryptoBilis and have not yet initialized them not to set them up, and has told customers who already used potentially affected devices to move assets to a new device with a newly generated recovery phrase.
The confirmed discovery of an implant in one affected device does not establish that every device in the wider catalog is compromised, or that every reported loss resulted from the same method. The distinction between confirmed findings, third-party estimates and separate device reports remains important while the investigation continues.
Why It Matters
Hardware wallets are sold on a simple promise: that self-custody keeps keys out of reach even if everything else fails. The current fight is about the fine print behind that promise: the difference between what a security feature does on a documentation page and how it gets described to a worried customer in a social-media reply.
The verifiable core is that Ledger’s Genuine Check, by Ledger’s own words, cannot detect physical implants if the Secure Element is left intact, and that a Ledger Support post in August suggested otherwise. Whether that rises to “misleading advertising,” as Karpelès alleges, or reflects an overstated support reply to a limitation Ledger had already published, is the question now being argued in public. The Crypto Times takes no position on the merits of that characterization and has sought Ledger’s response.
Also Read: Ledger Halts Sales in Seven Asian Markets as Tampered Devices Surface
