Former Mt. Gox CEO Warns of Malicious Ledger Devices with Hidden SIM Cards

Odaily Planet Daily reports that, according to Bitcoin News monitoring, after former Mt. Gox CEO Mark Karpelès publicly disclosed physically tampered Ledger devices containing hidden surveillance implants, he may have inadvertently triggered a coordinated transfer of funds from multiple wallets. On October 8, Karpelès warned that counterfeit or tampered Ledger devices containing hidden SIM cards were being sold on the market; these SIM cards are capable of transmitting stolen recovery phrases. The alleged implants can intercept data sent to the device’s screen, thereby capturing the recovery phrase displayed during wallet setup. Such devices are reportedly still able to pass Ledger’s official authenticity verification, as the original secure element remains intact and the verification process cannot detect unauthorized physical modifications. A growing theory suggests that attackers collect recovery phrases from compromised devices and wait to simultaneously transfer funds from multiple wallets. Karpelès’s warning, reportedly viewed around 90,000 times, may have alerted attackers that their activities had been exposed, prompting them to move the stolen funds. Karpelès stated that one compromised Ledger device he inspected originated from Malaysia, packaged in undamaged heat-shrink film, with an implant concealed beneath the screen. The suspected attack vector is a compromised hardware supply chain, rather than a cryptographic vulnerability. The connection between Karpelès’s warning and the subsequent wallet fund transfers has not been confirmed, nor has it been verified whether the same batch of implants was responsible. If substantiated, this incident would demonstrate that even hardware passing manufacturer certification can compromise user asset self-custody if compromised.