Ledger CEO Calls Ex-Mt. Gox Chief Karpelès “No White Knight” Over $90M Wallet Implants

Karpelès Points to a March Security Guide

Ledger chief executive Pascal Gauthier has told former Mt. Gox boss Mark Karpelès he is “no white knight,” after Karpelès accused the hardware wallet maker of knowing about advanced spy implants as early as March. Karpelès argues that clearer public warnings at the time could have prevented more than $90 million in user losses. What began as a technical dispute over device integrity has turned into the sector’s most visible public falling-out, fought out in open posts rather than in an incident report.

Karpelès helped expose the threat himself. Opening a sealed Ledger device, he found a hidden circuit board planted inside it. The implant can capture a wallet’s 24-word Ledger recovery key and transmit it to criminals, and that phrase gives them full control of every fund the device protects. That single secret restores a wallet anywhere, which is why capturing it empties accounts without any movement a victim could stop on-chain. Karpelès now argues Ledger knew about implants of this sophistication months before the losses mounted. He points to a security guide published on the company’s own site on March 6, showing both handmade and mass-produced spy chips. That guide was updated in September, which leaves open when the images actually appeared. More pointed still, Ledger acknowledges that its Genuine Check, the process meant to confirm a device ships genuine and unmodified, cannot detect an implant if the original security chip stays intact.

Gauthier initially defended Ledger’s response in a public post, urging Karpelès to stick to the facts. He then made it personal, writing in a post on X: “Coming from the Mt Gox CEO... Come on man, you are no white knight. Get real.” The jab referenced the 2014 collapse of Mt. Gox, when roughly 850,000 Bitcoin went missing under Karpelès' leadership. Karpelès answered that his own experience is precisely why he expects higher standards from this industry.

@_pgauthier · X post

Defended Ledger’s response.

View on X

Reseller Halts and European Tamper Reports

The clash lands while the distribution side of the business is already under correction. Ledger has halted reseller sales through CryptoBilis, dropping a named partner from its channel after the implant findings. Reports of tampered devices surfacing in Europe have widened concern past a single unit or a single market. Rival Trezor has already moved to shrink its own reseller network, a step that treats the problem as industry-wide rather than specific to one manufacturer.

For holders who keep substantial balances offline in a cold wallet, the dispute exposes a concrete weakness: even an authentic device offers no guarantee that the unit reaching their hands was never modified before sale. A sealed box no longer reads as proof of integrity, and a crypto wallet bought through a third party now carries a question it did not carry a month ago. The response so far has been procedural. Both manufacturers are trimming the number of hands a device passes through, and some holders are reviewing alternatives such as the Cypherock X1 wallet. Neither company has published a detection method that catches an implant when the original chip is left untouched, and neither has disclosed how many affected units reached customers.

The timing compounds the pressure. The September update to the company’s security guide means a buyer researching the risk before purchase could have read a page that had already been revised, with no public note of what changed or when. Resellers typically buy stock in bulk and move it through local storefronts, the same path the European tamper reports have followed, and that structure is what both manufacturers are now cutting back. Ledger has not said whether CryptoBilis stock was affected, and no European case has been tied to a specific shipment.

Ledger's Own Admission Sets the Limit

The argument matters less for the insult than for what both men have put on record. Gauthier’s posts are the company’s most explicit public response to date, and Ledger’s admission about Genuine Check fixes a hard boundary: an implant that leaves the original security chip untouched passes verification. The March 6 guide, published by Ledger itself, is the document anchoring Karpelès' prior-knowledge claim. Remediation so far targets distribution, with reseller cuts at both manufacturers, rather than detection. Three items stay unresolved: a working detection path, a disclosed count of affected units, and clarity on when the guide’s spy-chip images were added. Until those arrive, buyers hold only the manufacturers’ assurance that direct-channel devices are clean.