Heated Exchange on Hardware Wallet Security
Recently, Ledger’s CEO Pascal Gauthier and former Mt. Gox chief Mark Karpelès engaged in a heated exchange regarding the security of hardware wallets after reports emerged of significant cryptocurrency thefts linked to a Southeast Asian reseller, CryptoBilis. The dispute, ignited on October 17 via social media platform X, arose when Karpelès questioned Ledger’s transparency about modifications made to its wallets, which may have contributed to losses exceeding $90 million, as estimated by some researchers.
Concerns Over Communication and Security
Karpelès scrutinized Ledger’s communication strategies, claiming that warnings about the sophisticated tampering of their wallets weren’t adequately conveyed to users prior to the recent thefts. This scrutiny followed revelations that unauthorized electronics were found inside genuine Ledger devices, capable of capturing critical information like a wallet’s 24-word recovery phrase during initial setup and secretly relaying it to attackers via cellular networks.
While Gauthier defended Ledger’s proactive measures in safeguarding its customers, he took issue with Karpelès’s critique and urged him to be more careful about the facts he presented. Gauthier further emphasized the necessity of distinguishing between verified information and unverified claims in their discourse.
Drawing from Past Experiences
Karpelès responded by drawing from his experience leading the now-defunct Mt. Gox exchange, which collapsed in 2014 after suffering massive losses in Bitcoin, to highlight the importance of robust security communication from cryptocurrency companies like Ledger. This comment escalated the tension between the two, with Gauthier remarking on Karpelès’s controversial past and suggesting he was hardly in a position to question others’ integrity concerning security practices.
Investigation and Customer Guidance
At the core of their argument is a security article published by Ledger, although the timing of its revisions has raised further questions. Initially posted on March 6, 2026, and updated on September 18, the article addresses various threats linked to tampering of hardware wallets. However, it creates ambiguity regarding whether the company had knowledge of the specific risks associated with CryptoBilis prior to the recent breaches.
Ledger’s investigation into complaints from customers who acquired wallets via CryptoBilis began on October 9, prompting the company to request the suspension of sales from the reseller while they probed the reports regarding stolen cryptocurrency. They advised users against initializing wallets bought from CryptoBilis within the last three months. The outcomes of the investigation revealed at least one device possessing unauthorized alterations capable of intercepting vital recovery information.
Ongoing Dialogue on Security Practices
As independent evaluations cite varied loss estimates—with Galaxy Research reporting around $91 million in losses—questions regarding oversight of resellers and the robustness of Ledger’s technical safeguards have arisen. The episode serves as a reminder of the vulnerabilities that can exist even within credible channels of distribution in the crypto space. In light of the incident, Ledger has reiterated its guidelines for purchasing, urging customers to buy directly or from authorized distributors and to adhere to best practices for ensuring the integrity of their devices, while cautioning that certain protections do not guarantee immunity from potential physical tampering.
This ongoing dialogue underscores the critical importance of security and communication in the cryptocurrency industry, especially in the wake of increasing sophistication in threats against digital asset holders.
