Ledger CEO clashes with ex-Mt. Gox boss over $90M wallet thefts

What happened

Ledger CEO Pascal Gauthier and former Mt. Gox chief Mark Karpelès argued publicly on X on October 17 about how Ledger warned customers over tampered hardware wallets. Karpelès asked whether the company had made the danger of spying implants clear enough before buyers reported losses on devices sold through Southeast Asian reseller CryptoBilis. Gauthier defended Ledger's security work and asked him to stick to what he could substantiate.

Investigators found extra electronics inside a genuine Ledger device that could capture a wallet's 24-word recovery phrase during setup and send it out over a cellular link. Ledger paused CryptoBilis sales after the discovery. The company also said its Genuine Check cannot spot added spying parts when the original security chip is still in place.

Karpelès accepted that Ledger published a security article in March on tampered devices, but said guidance in an educational section was not enough for implants of this kind. He said a more prominent warning could have prevented over $90 million in losses. Gauthier replied that the company works hard to protect customers and that outsiders should separate evidence from speculation.

The exchange grew sharper when Gauthier brought up Karpelès's time running Mt. Gox, which collapsed in 2014 after large Bitcoin losses. Karpelès answered that his own experience of an exchange failure was a reason to expect stronger security communication from firms that hold customer assets.

Why it matters

The dispute centres on how clearly a wallet maker should flag a physical threat that its own checks may miss. Ledger said on October 15 that its security chips, operating system and servers were not breached, and that criminals compromised devices after the company lost control of them. It also said it would tighten rules for approved resellers, including a ban on selling returned products.

Karpelès has also started work on a low-cost device to test whether a Ledger wallet holds a spy implant without opening it. He says he will publish the circuit board design and technical specifications so others can build the detector. No fully working, independently verified version has been shown.

What is still unclear

• Researchers put losses above $90 million, but Ledger has not confirmed that figure as a final verified total.
• Karpelès's claim that earlier warnings could have prevented the losses remains unproven, and the public argument does not show that Ledger intentionally hid information about the CryptoBilis case.

Questions readers ask