Mark Karpelès Says Ledger Spy Implant Turned Up in Devices From 2 More Authorized Resellers

Introduction

Recent disclosures by Mark Karpelès, CEO of the Tokyo‑based Karpelès Lab, have added new twists to the ongoing controversy surrounding alleged spy implants in Ledger hardware wallets. After initially reporting an implant in devices sold by the Southeast Asian reseller CryptoBilis, Karpelès now says similar hardware was discovered in a Ledger Flex purchased in Singapore and a Ledger Nano X obtained from a German retailer. He describes the latest version of the implant as engineered for mass production, a claim Ledger has partially contested.

New Findings from Singapore and Germany

Karpelès detailed his observations during an Unchained livestream on October 15. The first new device was a Ledger Flex bought from Metapod, a reseller operating a kiosk at Singapore’s Changi Airport. According to Karpelès, the implant in the Flex was customized for that model but retained the same three‑chip architecture he previously described: one chip reads the screen, another functions as a cellular modem, and a third acts as an eSIM to transmit data.

The second device was a Ledger Nano X purchased at MediaMarkt in Germany. A user known as Johannes sent two units to Karpelès—one for analysis and one for Ledger. Karpelès reported that the implant in the Nano X was installed slightly differently than the Southeast Asian units but appeared to be the same underlying hardware.

Ledger’s Response

Ledger has acknowledged the broader issue but limited its public statements to the confirmed incidents involving CryptoBilis. In an October 14 post, the company said it inspected retail and distributor stock in Germany, including the MediaMarkt locations mentioned, and found no visible signs of tampering. Ledger also noted that it has not yet examined the specific devices shown online by users.

Johannes later commented that other units in the store appeared clean, though Karpelès cautioned that he could not definitively confirm whether the MediaMarkt batch contained only the single compromised unit.

The Shift Toward Mass‑Production

A key point raised by Karpelès is the evolution of the implant’s design. Earlier versions required a board wired directly into the wallet’s circuitry. The newer iteration, he claims, uses a blank board that simply clips into place, allowing for faster assembly and scalability. He suggested that months of research and significant funding have enabled this shift, implying that future incidents could become more widespread.

Karpelès stopped short of calling for the termination of Ledger’s authorized reseller program, labeling such a move “probably too drastic.” Instead, he advocated for tamper‑evident packaging as a practical mitigation step.

Practical Takeaways

• Stay Informed: Users should monitor updates from both Ledger and independent security researchers regarding potential hardware tampering.
• Verify Sources: Purchasing from reputable, directly‑authorized channels remains advisable, though the recent findings highlight that even authorized resellers can be compromised.
• Consider Packaging: Look for signs of tampering on the device’s seal and packaging before use.
• Maintain Vigilance: Keep firmware updated and follow best practices for securing private keys, such as using air‑gapped environments for critical operations.

Conclusion

The emergence of a purported mass‑production spy implant in Ledger wallets underscores the evolving threat landscape for crypto hardware security. While Ledger disputes evidence of tampering in its inspected German stock, Karpelès’ claims suggest a more sophisticated supply‑chain risk. Users should remain cautious, prioritize verified purchase channels, and stay attuned to ongoing investigations as the community seeks clearer answers.