Mark Karpelès, the former CEO of Mt. Gox, claims he found a tampered module containing a communications chip inside a Ledger Nano X device originating from Malaysia, causing concern.
As hardware wallet manufacturer Ledger investigates the large-scale theft of virtual assets affecting buyers from CryptoBilis, an authorized reseller in Southeast Asia, former Mt. Gox CEO Mark Karpelès said he discovered a hardware tampering device suspected to be a spy module in a Ledger Nano X device delivered to him in Malaysia.
According to Karpelès, the device appeared normal, with its shrink-wrap packaging externally intact. However, after disassembly, a separately manufactured circuit-board module was found concealed where the display pad should have been. The module contained a communications microcontroller, an antenna, a cellular communications chip and a SIM (eSIM) card. It was analyzed as being capable of intercepting recovery-word (seed phrase) data displayed on the screen and transmitting it over an external mobile network. Unlike earlier forms of manual modification that used crudely connected wires, the module had been precisely machined in the form of genuine components, prompting concerns that ordinary users would have difficulty detecting the tampering by sight.
The findings starkly illustrate the risks of a supply chain attack targeting the manufacturing and distribution processes of hardware wallets. Ledger’s existing device-authentication function can determine the firmware integrity of the core Secure Element, but it has a technical limitation: it cannot detect hardware compromise devices installed outside the Secure Element that directly tap display signal lines.
Ledger, however, has not confirmed an official position on the module’s specific operating method or its direct connection to the recent virtual-asset theft incidents involving CryptoBilis buyers. Security experts likewise cautioned that, while the board’s communications and theft capabilities have been confirmed at this stage, additional technical verification and investigation are needed to determine whether the same module was directly used in the actual large-scale theft.