Pascal Gauthier runs Ledger, the company that builds hardware wallets for storing crypto offline. On Oct. 17, 2026, he answered a security complaint with seven words. "You are no white knight. Get real," he wrote to Mark Karpelès on X1. Karpelès ran Mt. Gox, the exchange that lost 850,000 bitcoin in 20146. He had just told Gauthier something sharper. A louder warning from Ledger could have saved its customers more than $90 million, he said2. Ledger's own hardware implants had already drained up to $93 million from more than 300 wallets4.
What Karpelès Warned, and What Gauthier Said Back
Karpelès posted first, at 1:03 p.m. UTC on Oct. 17, 20262. His message named a cost and a channel. “I do know a better communication on this at the time instead of a single article buried in the 'ledger academy' could have saved 90+ million USD of losses. I know it's a difficult job, but I can't fathom how you could have failed to be ALARMED by mass produced advanced implants,” he wrote. The post drew 314 likes, counted as of Oct. 18, 2026.
Gauthier answered 71 minutes later1. He skipped the dollar figure and went straight for the messenger. “Coming from Mt Gox CEO... Come on man. You are no white knight. Get real,” he wrote. His reply pulled 68 likes and 138 replies by the same count. PANews, which covered the exchange on Oct. 18, 2026, reported that Gauthier also pressed Karpelès to argue from known facts rather than speculation3.
Both replies skipped the other's claim. Karpelès named a number. Gauthier named a biography. The reader is left to judge the warning on its own, apart from who delivered it.
Both sides, in their own words
Does a sharp reply settle whether Ledger warned its own customers soon enough?
“Coming from Mt Gox CEO... Come on man. You are no white knight. Get real”
“Maybe Ledger not responding to a single event of an implant found on a Ledger purchased from a shady dealer is normal. However the increasing number of reports they must have received, and the increasing quality and technology used should have alerted them enough to act, and at least remind customers to be careful”
Why Ledger Needed a Warning at All
The fight traces back to Oct. 9, 2026. Attackers drained wallets tied to devices sold through CryptoBilis, a reseller operating in Indonesia, Malaysia, and the Philippines4. Ledger confirmed the cause on Oct. 10, 2026. “Ledger can confirm that one of the impacted users' devices contained an unauthorized hardware implant,” the company said. Ledger told buyers of CryptoBilis devices to stop. “Do not initialize unused devices. If already set up, move to a new seed on a device from Ledger,” it said.
Researchers who examined the hardware found two separate designs. One used a Cortex-M4 microcontroller and a 2-millimeter eSIM, swapped in behind a smaller battery9. The implant read the screen and button presses to catch a seed phrase, then sent that phrase out over a cell connection. A second, more advanced design hid inside the foam padding under the display and ran on the original battery. Its antenna wire ran along the top edge, BleepingComputer reported. Ledger's own authenticity check misses an added implant whenever the original security chip stays intact, the same report found.
One tally puts the theft at $93.2 million across 315 wallets on six networks7. Tron carried the largest share, at $70.5 million, with bitcoin next at $16.8 million across 203.8 BTC and 111 addresses. Ethereum carried $3.7 million of the total, the smallest of the three biggest chains hit. Tether froze roughly $10 million in stablecoins tied to the theft, and attackers moved about 2,990 ether through Tornado Cash. Binance co-founder Changpeng Zhao offered one theory for how the implants reached buyers at all. “What's crazier is the hackers apparently bought the reseller and made them sign a non-disclosure agreement,” he wrote, a claim Ledger and CryptoBilis have each left unconfirmed.
A separate post on Oct. 11, 2026, said the problem reached past Asia. “PSA the ledger incident isn't limited to Asia. This is a device purchased in store from an official reseller in Europe,” trader Johannes posted on X, in a message CryptoTimes captured7. That post undercuts the frame Ledger gave the theft on Oct. 10: a reseller problem, contained to three countries4.
Tron carried $70.5 million of the $93 million Ledger theft, Oct. 9, 2026
Losses from the Oct. 9, 2026 CryptoBilis implant theft, by blockchain, in millions of US dollars
- Tron: $70.5M
- Bitcoin: $16.8M
- Ethereum: $3.7M
Source: CryptoTimes [7].
Read the chart as a table
| Item | Value |
|---|---|
| Tron | $70.5M |
| Bitcoin | $16.8M |
| Ethereum | $3.7M |
The Warnings Ledger Had Months Before
Karpelès says Ledger already had reports like this one. He told Cointelegraph he knew of at least two people who had separately reported tampered devices to Ledger in December 202558. One was the Vietnamese crypto educator Tai Zen. Security researcher Joe Grand gave Ledger a sharper signal still. Grand alerted the company on March 4, 2026. He had found a malicious implant inside a Nano X, bought from a Lazada Thailand merchant called "LedgerXXX". Ledger acknowledged Grand's report and opened an internal investigation, but it stopped short of a public warning to buyers.
7 months passed between Ledger's first implant warning and its Oct. 9 theft
Dated steps from the first reported Ledger implant to the Gauthier-Karpelès exchange on X
Sources: X [1]; CoinDesk [4]; Cointelegraph [5]; FinanceFeeds [8].
Read the chart as a table
| Date | Event |
|---|---|
| Dec. 2025 | Tai Zen reports a tampered device. Karpelès says a Vietnamese crypto educator separately told Ledger about a suspected implant |
| March 4, 2026 | Joe Grand warns Ledger. Security researcher Joe Grand alerts Ledger to an implant inside a Nano X bought from Lazada Thailand |
| Oct. 9, 2026 | CryptoBilis theft begins. Attackers drain wallets tied to devices sold through the reseller CryptoBilis |
| Oct. 10, 2026 | Ledger confirms the implant. Ledger says one affected device held an unauthorized hardware implant |
| Oct. 17, 2026 | Gauthier tells Karpelès to get real. Gauthier answers Karpelès' $90 million claim with a dig at his record running Mt. Gox |
Rival wallet maker Trezor laid out its own bar for when a quiet report becomes a public one. “What changes the picture is a new technique, or a first case coming through an authorised channel. Either one means the problem has moved closer to ordinary buyers, and that's when we'd move fastest, including warning customers directly,” the company told Cointelegraph5.
Karpelès made the connection to Gauthier plainly. “Maybe Ledger not responding to a single event of an implant found on a Ledger purchased from a shady dealer is normal. However the increasing number of reports they must have received, and the increasing quality and technology used should have alerted them enough to act, and at least remind customers to be careful,” he told Cointelegraph5. Seven months passed between Grand's warning and the CryptoBilis theft Ledger confirmed in October4.
The Case for Gauthier, and the Case Against Him
Gauthier's defense rests on who is making the complaint. Karpelès ran Mt. Gox when it lost 850,000 bitcoin and filed for bankruptcy on Feb. 28, 20146. A Tokyo court convicted him in 2019 of falsifying Mt. Gox's own electronic records, though it cleared him of embezzlement, and handed him a suspended two-and-a-half-year sentence. "Get real" reads, in that light, as a question about standing. Why should the executive behind crypto's most infamous collapse get to grade someone else's crisis response?
Karpelès' case rests on something Gauthier's reply skipped: Joe Grand's name and his March timeline. Grand carries zero corporate rivalry, unlike a competing chief executive answering for his own record. He is a security researcher who found a working implant and told Ledger directly. Ledger investigated quietly, rather than warn its own customers58. Trezor's own standard says a case reaching buyers through an authorized channel is exactly the trigger for a direct warning. Grand's Nano X came from a listed reseller, Lazada Thailand. That gap between a private acknowledgment and a public warning is the exact gap Karpelès says cost Ledger's customers $90 million2. A dismissive reply answers the critic's history. Gauthier's reply leaves Grand's March finding unanswered.
Both halves of this argument can hold at once. Karpelès' past gives Gauthier a real line of attack, and Grand's past gives Karpelès a real number to point to. A reader checking both records finds a messenger worth doubting and a message worth checking anyway.
By the numbers
- $93 million: the top loss estimate tied to the CryptoBilis implants, CoinDesk reported Oct. 12, 20264.
- 300+: wallets Ledger said were hit by confirmed implant cases, as of Oct. 12, 20264.
- Six: networks the stolen funds crossed, one tracing firm's tally found7.
- $70.5 million: Tron's share of that theft, the same tally found7.
- March 4, 2026: the date Joe Grand first warned Ledger about a device implant, seven months before the CryptoBilis theft58.
- $90 million: the loss Karpelès said a louder warning could have prevented, in his Oct. 17, 2026 post2.
- 314 and 68: the like counts on Karpelès' and Gauthier's posts, each counted as of Oct. 18, 202612.
- 2.5 years: the suspended sentence a Tokyo court gave Karpelès in 2019 for falsifying Mt. Gox's records6.
What to watch
Watch whether Ledger names a broader customer notice beyond its Ledger Academy post, the step Karpelès says should have come sooner. A statement from CryptoBilis on how the implants reached its stock would help settle how the devices got out. Joe Grand's own account of what happened between March and October would clear up the timeline better than either executive's post on X.
Sources
- Pascal Gauthier (@_pgauthier), reply on X, Oct. 17, 2026, https://x.com/_pgauthier/status/2111460751449694354
- Mark Karpelès (@MagicalTux), post on X, Oct. 17, 2026, https://x.com/MagicalTux/status/2111442933211959395
- PANews, "Ledger CEO hits back at former Mt. Gox CEO: You're no white knight, stick to facts instead of speculation," Oct. 18, 2026, https://panews.io/articles/01a14e55-f501-747f-b4de-e0a40c455f8b
- Omkar Godbole, "Ledger Says Unauthorized Implant Found in At Least One Device Sold by CryptoBilis," CoinDesk, Oct. 12, 2026, https://www.coindesk.com/tech/2026/10/12/ledger-says-unauthorized-implant-found-in-at-least-one-device-sold-by-cryptobilis
- Helen Partz, "Ledger's early implant warnings deserved more action, Karpelès says," Cointelegraph, Oct. 16, 2026, https://cointelegraph.com/news/ledger-early-implant-warnings-mark-karpeles
- Yogita Khatri, "Mt. Gox's Mark Karpeles Found Guilty Over Data Manipulation in Tokyo Court," CoinDesk, March 15, 2019, https://www.coindesk.com/markets/2019/03/15/mt-goxs-mark-karpeles-found-guilty-over-data-manipulation-in-tokyo-court
- Jahnu Jagtap, "Ledger CryptoBilis Hack Explained: $93M Stolen, Wallets Tampered," CryptoTimes, Oct. 12, 2026, https://www.cryptotimes.io/2026/10/12/ledger-cryptobilis-hack-explained-93m-stolen-wallets-tampered/
- Abdelaziz Fathi, "Ledger Got Implant Warnings Months Before $86M+ Losses," FinanceFeeds, Oct. 16, 2026, https://financefeeds.com/ledger-was-warned-of-tampered-devices-as-early-as-2025/
- Bill Toulas, "Ledger Confirms Spy Chip Implant Behind Wallet Crypto Thefts," BleepingComputer, Oct. 12, 2026, https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/