Ledger Warned of Malicious Hardware Wallet Implants Months Before Security Crisis

These early signs of threat to Ledger hardware wallets were not widely publicized, despite known alerts from customers.

Karpelès told Cointelegraph that at least two individuals reported tampered Ledger devices starting in December 2025, but he noted that Ledger did not issue any public warnings in response.

Security researcher Joe Grand informed Ledger on March 4, 2026, about a malicious implant found in a Nano X wallet bought on Lazada Thailand in August 2025.

Grand mentioned that while Ledger acknowledged his discovery and launched an internal probe, they failed to proactively alert users about the danger.

According to Karpelès, Vietnamese crypto educator Tai Zen also reported suspicions of a hardware implant to Ledger in December 2025.

The current Ledger security crisis came to light on October 9, following cryptocurrency losses related to wallets sold through CryptoBilis, a Southeast Asia authorized reseller. Ledger confirmed one infected device contained an unauthorized implant.

Ledger declined to comment specifically on their handling of Grand’s report and referred inquiries to their public statements on X.

Karpelès suggested that Ledger’s silence on isolated implant cases from questionable sellers might be standard, but he cautioned that the growing number and sophistication of implant reports should have compelled Ledger to act and remind customers to take precautions.

The incident exposed weaknesses in verifying authorized resellers on marketplaces, where counterfeit devices were sold.

Grand identified the seller of the compromised Ledger device as “LedgerXXX” on Lazada, which is not an authorized reseller in Thailand, although Lazada hosts an official Ledger store.

Attempts to clarify the seller’s identity and authorization status from both Grand and Ledger were made by Cointelegraph.

Archie, head of sales at hardware wallet maker OneKey, explained that marketplaces like Lazada feature many independent sellers, making it hard for customers to differentiate authorized vendors from others.

In response to recent events, OneKey has suspended its reseller listings until stricter vetting processes are established, emphasizing manufacturers’ responsibility to protect customers instead of placing the burden solely on buyers.

Grand’s findings extended beyond Ledger; in August 2026, he also reported tampered Trezor One and Model T wallets bought from unauthorized sellers on TikTok and Facebook.

Trezor confirmed to Cointelegraph that counterfeit wallets occasionally surface from unauthorized sellers and referenced a 2022 warning about modified devices sold on Russian marketplaces. Their statement about no compromised devices applies only to new wallets sold through authorized resellers.

Nonetheless, Trezor treats reports involving unauthorized sellers as early alerts and uses researchers’ insights to enhance security measures.

Trezor disclosed that detection of new tampering techniques or first cases via authorized channels signals that the threat is reaching regular customers, prompting swift actions including direct warnings to users.

The warnings about tampered wallets and unauthorized reseller risks underscore the crucial need for vigilance and stricter controls in the hardware wallet supply chain to protect cryptocurrency holders. They reveal vulnerabilities that, if unchecked, threaten user asset security. This situation spotlights the importance of ongoing monitoring and rapid response to emerging hardware wallet tampering threats.

The sequence of early reports starting in late 2025 illustrates that Ledger faced clear signs of malicious hardware implants well before the public security crisis erupted in late 2026. Yet, the absence of proactive customer alerts and persistent gaps in reseller verification allowed compromised wallets to continue reaching users, resulting in financial losses. Marketplaces hosting numerous independent sellers create challenges for authenticating authorized distributors, which manufacturers and the crypto industry must urgently address. Additionally, the case of Trezor wallets also highlights that this is a broader industry issue, not isolated to a single brand. Effective detection, transparent communication, and robust reseller vetting are critical defenses against hardware wallet supply chain attacks and crucial for maintaining user trust.