Mark Karpelès, CEO of Tokyo-based Karpelès Lab, said the spy implant discovered in Ledger hardware wallets sold by Southeast Asian reseller CryptoBilis has also appeared in devices from two more authorized Ledger resellers, and that the latest version appears built for mass production.
Speaking on Unchained’s Oct. 15 livestream, Karpelès said one of the devices was a Ledger Flex purchased from Metapod, a reseller that operates stores at Singapore’s Changi Airport. He said the implant had been customized for the Flex, but described it as the same type of board and the same three-chip process.
According to Karpelès, one chip reads the screen, one is a cellular modem, and one is an eSIM that sends the data.
The other device, he said, was a Nano X purchased at MediaMarkt in Germany by X user Johannes. Karpelès said Johannes sent one unit to him and another to Ledger.
Karpelès said the unit sent to him arrived on Oct. 15 and that he found an implant inside. He said it had been installed a little differently from the Southeast Asian units, but added, 「It’s surely the same implant.」
Karpelès first reported the Flex on X on Oct. 13. Johannes shared photos of his MediaMarkt unit on Oct. 11, and Karpelès posted his own MediaMarkt findings earlier on Oct. 15.
What Ledger has said
Ledger has said that every confirmed drain linked to the Oct. 9 wave involved devices sold by CryptoBilis.
MediaMarkt Saturn halted Ledger sales on Oct. 13 in coordination with Ledger. Ledger also asked sellers in seven Asian markets, including Singapore, to pause sales.
In an Oct. 14 post, Ledger said its team inspected devices from retail and distributor stock in Germany, including the stores named in the reports, and found no signs of tampering. The company added, 「We have not yet been able to examine the devices shown online.」
Johannes replied that the other units at the store appeared to be clean. Karpelès said he could not say for sure whether the units Johannes found were the only tampered devices at MediaMarkt.
Karpelès says the implant now looks ready for scale
In Karpelès’s account, the implant has evolved from a board that had to be wired into the device to blank boards that clip into place. On the Nano X, he said, the board will basically just fall into place.
He said the people behind it had spent months on research and development and pointed to what he described as significant funding.
Karpelès said implants like this used to be expensive and narrowly targeted, but described the new version as made for mass production. He added that 「we’re likely going to see a lot more of it in the future.」
Asked whether Ledger should shut down its authorized reseller program, Karpelès said that would be probably too drastic. He suggested tamper-evident packaging instead.