Mark Karpeles Builds Tool to Detect Ledger Implants

A New Hardware Solution for Ledger Security Concerns

Former Mt. Gox CEO Mark Karpeles has stepped forward with a new project aimed at helping crypto users check their hardware wallets for physical tampering.

The initiative comes at a critical time for French hardware wallet manufacturer Ledger, which recently faced reports of doctored devices circulating through third-party supply channels.

Karpeles took to social media platform X to share details about his work, raising a question that many hardware wallet owners have been asking: "Is my Ledger safe? Is there a spy implant in it?"

Rather than forcing users to pry open their devices—which risks destroying the plastic casing and damaging internal electronics—Karpeles believes it is possible to scan for hidden implants externally.

How the Physical Implant Detector Works

Spotting unauthorized hardware components inside a sealed electronic device is notoriously difficult without specialized lab equipment.

To solve this, Karpeles is designing an affordable scanner intended to detect unauthorized internal antennas without needing physical disassembly.

The detection method works using low-power radio signals and resonance testing.

When radio waves pass through an electronic device, metallic structures and antennas absorb and reflect energy at specific frequencies. By measuring these resonance patterns, the scanning tool can tell if extra antennas have been hidden inside the case.

Karpeles announced that he plans to make the printed circuit board (PCB) design and technical specifications open-source.

By publishing these technical files publicly, anyone with basic soldering skills or technical curiosity will be able to build their own detection unit at home.

However, Karpeles noted that he has not yet released a fully functional, independently verified prototype to the public.

Inside the Southeast Asian Supply Chain Breach

This detection initiative follows a major physical supply chain breach involving tampered Ledger wallets sold by an unauthorized reseller in Southeast Asia.

Attackers obtained authentic, factory-original hardware wallets through gray-market channels.

Once in possession of the legitimate devices, the bad actors opened the plastic housing, soldered tiny electronic implants onto the circuit board, and resealed the packaging to look completely untouched.

The modified devices were then placed back into secondary market distribution channels and sold to unsuspecting customers.

How Bad Actors Intercepted Seed Phrases

The hidden physical implants carried out a sophisticated form of data interception.

Inside each doctored device, attackers had fitted a secret cellular transmitter equipped with an integrated eSIM card.

When a new owner set up their altered Ledger wallet, the device generated a standard 24-word recovery seed phrase on its screen.

As the recovery phrase was generated during initialization, the hidden implant captured the text and transmitted the 24 words over an LTE mobile connection straight to the attackers.

With full knowledge of the recovery phrase, bad actors could restore the wallets on their own devices and drain funds instantly.

Independent security researchers estimate that total digital asset losses linked to these tampered devices exceed $90 million.

Ledger Official Statement and Security Guidelines

On October 15, Ledger issued an official statement to address user concerns regarding the tampered units.

Ledger clarified that its core security chips, custom operating system (BOLOS), and server architecture were never compromised or hacked.

Instead, the vulnerability was purely a physical supply chain attack that occurred after the devices had left Ledger's direct custody.

To reduce the risk of future physical tampering, Ledger has implemented stricter channel rules for approved vendor networks:

• Strictly banning official resellers from reselling any returned or opened customer units.
• Requiring retail stores to keep physical devices secured out of public reach until an actual sale is completed.
• Increasing surveillance and verification requirements across all approved international logistics partners.

Key Takeaways for Hardware Wallet Owners

Hardware wallets remain one of the most reliable methods for securing self-custody digital assets, provided the physical chain of custody remains unbroken.

To maintain safety, users should buy devices directly from original manufacturers or authorized primary vendors, avoiding unverified third-party listing platforms.

If Mark Karpeles successfully completes and open-sources his scanner device, it could give the community a practical tool to inspect second-hand or older hardware devices safely.