Karpeles Lab CEO Mark Karpelès said the first version of the screen-reading hardware implant was discovered in December 2025 and that the issue had been discussed for at least six months. Karpelès said Ledger should have warned customers buying from authorized resellers to open their wallets and compare the internal components against the photos in the user manual, noting the manual states on the same page that opening a device voids the warranty.
While Ledger has maintained that all confirmed fund losses trace to Malaysian reseller CryptoBilis, Pangolin Intelligence researcher Jonty said other authorized Southeast Asian resellers also sold tampered devices that resulted in stolen cryptocurrency, with onchain evidence showing wallet drains by the same attacker as early as Sept. 8. Security researcher Taylor Monahan warned that recent loss reports increasingly stem from panicked Ledger owners falling for phishing sites, fake apps and phone scams rather than the LTE hardware implants, which third-party researchers estimate have drained $86 million to more than $100 million.