Mark Karpelès: cold wallets cut malware theft, so attackers hit the hardware

Mark Karpelès, chief executive of Karpelès Lab and the former CEO of Mt. Gox, argued on the Unchained episode Ledger Wallets Were Drained of $100 Million. Is Self-Custody Still Safe?, published 16 October 2026, that hardware-wallet supply-chain implants have moved from an expensive technique reserved for a handful of targeted victims to a mass-producible one, and that this shift is itself evidence cold wallets had already cut malware-based theft. He made the case alongside an on-chain analyst with SEAL 911 who founded Pangolin Intelligence, discussing the more than $90 million drained from Ledger hardware wallets sold through CryptoBilis, a Malaysia-based reseller. The argument reframes a theft of more than $90 million not as proof self-custody failed, but as proof attackers had to go further to beat it.

The argument

Karpelès described how the implants found inside tampered Ledger devices had changed: "The one thing that has changed is that this new implant is made for mass production and ease of installation." (from 0:00)

Karpelès, who received and opened a tampered Ledger Flex bought at Singapore's airport, described the implant: "it's still the same kind of board on the same process of having three chips, one which is monitoring the screen and taking note of the passphrase." (from 12:24)

Asked whether self-custody was still viable, Karpelès explained why cold wallets reduce what an attacker can reach in the first place: "by having your private key and performing the signature on a separate device which has a limited connectivity option, like for example only USB and Bluetooth, which basically limits the attack surface" (from 32:59)

He then made the claim the episode turned on: "self-custody on cold wallets or hardware wallets has been successful and has reduced the crypto theft from virus enough for those criminal groups to move to find ways to attack those devices" (from 32:59). Ledger, he added, was the obvious first target: "Ledger having, I believe, the largest market share in terms of wallets out there was probably the first target, basically where there was the most to gain." (from 33:57)

What it rests on

Ledger's own 15 October 2026 statement says its chip, operating system and servers were not compromised, and that this was a localized distribution attack on resellers rather than a systemic supply-chain breach. That is consistent with Karpelès's account: the implant taps the signal feeding the screen rather than the chip itself.

Karpelès had earlier documented implants in devices sourced from Malaysia, where CryptoBilis is based. Estimates of the total loss vary by tracker: Bitquery traced $93.2 million across six blockchains from 315 wallets, while YFarmX put the figure at $94.5 million from 521 addresses on seven blockchains, and Tether froze about $10 million in USDT tied to the theft; Ledger itself has not published a loss figure.

Sources also disagree on how far the problem spread. Ledger's statement says teams that spot-bought and opened devices in Germany and examined samples from warehouses found every unit clean. But on 11 October, four days before that statement, Bitcoin.com reported that an X user had posted evidence of an implant in a Ledger reportedly bought from MediaMarkt, a German electronics chain; Karpelès commented that its antenna was marked as a "Eurasian version". Ledger's post does not address that report.

Where it was discussed

• Unchained: Ledger Wallets Were Drained of $100 Million. Is Self-Custody Still Safe?, 16 October 2026, from 0:00