Person
French software developer who ran the Mt. Gox bitcoin exchange until its 2014 collapse.
Researcher Joe Grand says he told Ledger of an implanted Nano X on March 4, 219 days before the Oct. 9 CryptoBilis wallet losses. The case that Ledger gave no public warning rests on Grand's criticism and Mark Karpelès saying he has seen none.
Reality
Ledger disclosed on October 13 that an implant in a signer sold by CryptoBilis captures 24-word recovery phrases and sends them over LTE. Every fund loss Ledger has verified involved devices bought through that reseller.
Perspective Coverage
8 publishersReality
Ledger confirmed on Oct. 10 that one affected customer's wallet held an unauthorized implant, after drains that trackers put near $93 million. That proves tampered hardware reached a victim, but investigators have not tied comparable equipment to the rest of the losses.
Perspective Coverage
22 publishersReality
MediaMarktSaturn removed all Ledger products from its stores and online platforms over tampering reports. The public German evidence is an X user's claim that two wallets held cellular modules. Ledger did not answer Cointelegraph on whether it has confirmed any tampered device in Europe.
Perspective Coverage
6 publishersReality
Ledger asked resellers in seven Asian markets to pull its wallets from shelves on October 14. It has not tied a suspected implant in a Flex from a second reseller to the first cases, so how far the tampering reaches is open.
Perspective Coverage
7 publishersReality
Ledger told owners of Nano X wallets bought from CryptoBilis to discard them after spy chips were linked to more than $86 million in thefts. A Nano X bought in Europe and a Ledger Flex have since been reported with the same implant.
Reality
MediaMarktSaturn has pulled Ledger wallets from its roughly 1,070 stores and websites in every country it operates in. Ledger ties every confirmed case to a Southeast Asian reseller, but one buyer says he found modified units at two MediaMarkt stores.
Reality
X users say tampered Ledger wallets also came from MediaMarkt in Germany and LazMall in the Philippines, beyond the CryptoBilis batch Ledger confirmed. Karpelès has examined pictures of the LazMall unit; the MediaMarkt claim rests on one account.
Reality
On-chain analyst Specter traced more than $86 million drained from hundreds of Ledger hardware-wallet users across Ethereum, TRON and Bitcoin. With the cause unconfirmed, holders cannot yet tell whether moving coins to a new device would help at all.
Perspective Coverage
10 publishersReality
Researcher @0xJohannes_ says a second Ledger bought at a different MediaMarkt store has the same hidden cables and LTE module as his first. His account does not show where the tampering happened, so the Aqipa link names a supplier and locates no fault.
Reality
User @0xJohannes_ says the Ledger he bought at MediaMarkt holds extra internal wiring, a European report after a $93.4 million drain in Asia. Ledger says all confirmed cases came through CryptoBilis, so a compromised European retail channel is unproven.
Reality
X user Johannes says his MediaMarkt Ledger holds an early version of the implant tied to an estimated $93.4 million in Asian losses. Ledger has not confirmed the link or the estimate, so retail buyers have no official answer on provenance.
Reality
Ledger paused sales through authorized reseller CryptoBilis after investigators put suspected losses among its customers near $90 million. How the wallets were breached is still unknown. Ledger's fix is a new device with a fresh recovery phrase, which puts the suspicion on the sales channel.
Reality
Onchain Lens traced 430.2 ETH, about $1.07 million, from a suspect in the Ledger CryptoBilis reseller breach into Tornado Cash, plus $270,280 into Binance. The flows are under 2% of the $70.6 million TokenPost valued in the suspect's wallets, so most of what the suspect holds has not been traced to a mixer or exchange as Ledger investigates.
Reality
Ledger told Malaysian reseller CryptoBilis to stop all sales while it investigates losses a pseudonymous analyst puts above $86 million. For anyone holding crypto on hardware wallets, the shop each device came from is now part of its security.
Reality
The request came from an unauthorized account on a real government domain, and Revolut acted on it. The company calls the number of affected customers limited, and it declined to say how many or name the agency.
Perspective Coverage
5 publishersReality
The group calling itself iamnotavillain wants 6,000 Monero within 24 hours and Revolut says no demand has reached it. The data went out through a government email account the bank was obliged to answer.
Perspective Coverage
3 publishersReality