A Disgraced Mt. Gox CEO Exposed Spy Chips in Ledger Wallets. The Reseller That Sold Them Went Silent.

What happened. In early October 2026, blockchain investigators began tracking a wave of thefts from Ledger hardware wallets — cold-storage devices designed to be immune to remote hacking. Estimates converged around $86–93 million drained from roughly 300 wallets across Bitcoin, Ethereum, Tron, BNB Chain, Polygon and Solana. Every victim traced back to one thing: they had bought their device from CryptoBilis, an authorized reseller covering Malaysia, Indonesia and the Philippines.

The redemption twist. On October 9, Mark Karpelès — the disgraced former CEO of Mt. Gox, the exchange whose 2014 collapse cost users roughly 850,000 bitcoin — posted that his own Ledger Nano X, bought through a Malaysian channel, concealed a hidden circuit board behind the screen padding. He described an LTE module, an eSIM, an antenna and a microcontroller wired into the screen's data bus: hardware built to read a recovery phrase off the display and quietly transmit it out, timed for when a thief could move in.

Ledger's response. On October 10, Ledger Support confirmed it directly: "Ledger can confirm that one of the impacted users' devices contained an unauthorized hardware implant." The company told anyone who'd bought from CryptoBilis in the prior 90 days not to set up the device at all, and told anyone already using one to move funds to a new device with a fresh seed phrase immediately. A day later it posted a public 72-hour update on X, saying it was working with law enforcement, that the number of affected devices was limited, and that it was contacting known victims directly — while stressing that Ledger's own factories, systems and direct sales channel showed no sign of compromise.

The reseller's response. CryptoBilis suspended sales of all hardware-wallet brands across its stores while the investigation continued — but stopped there. A co-founder going by "Prabu" posted on X that the company had been sold back in March and that the original founding team no longer had any operational, management or systems access, pointing questions toward a new contact instead. CryptoBilis itself did not directly address the tampering allegations or answer media requests for comment. Binance founder Changpeng "CZ" Zhao said publicly he believed attackers had bought the reseller specifically to plant the implants, under a non-disclosure agreement that kept the sale quiet — a claim neither Ledger nor CryptoBilis has confirmed.

The competitor's move. OneKey, a rival hardware-wallet maker that also sold through CryptoBilis, cut the reseller's authorization entirely on October 12 and offered free replacement devices to anyone who'd bought a OneKey wallet through CryptoBilis since March 1 — no questions about activation status or usage, with claims accepted through the end of the year. OneKey said no customer losses had been reported on its side, but it was re-vetting every reseller in its network regardless.

Takeaways:

1. A supply-chain compromise doesn't dent only the company whose name is on the box — it tests every brand sharing that reseller's shelf space, and only one of them moved first.
2. Confirming a problem in public, fast and in plain language, is what actually buys a company room to investigate. Ledger's "we can confirm" beat vague reassurance.
3. "The ownership changed in March, talk to someone else" answers a liability question, not a customer's question. Silence on the substance reads as evasion regardless of who's technically at fault.
4. Generosity that costs money before all the facts are in — OneKey's no-questions-asked replacement offer — is what a reputation for trustworthiness is actually built from.
5. Even a reputation as damaged as Mark Karpelès' can be partially rebuilt by one well-timed, well-documented public warning that protects other people's money.

Sources: CoinDesk, Gizmodo, Help Net Security, BleepingComputer, The Defiant.

When a crisis starts outside your own walls — in a reseller's warehouse, a partner's supply chain, a vendor you don't fully control — the instinct to wait for certainty before speaking is exactly what costs a brand its trust. CGS.GURU helps companies build the response playbook before the incident, not during it: contact us to talk through your exposure.