Key Notes
- Mark Karpelès has launched a public database linking Ledger device reports to photographs, sellers and original sources.
- On October 15, the project listed 12 implant cases, two counterfeit devices and one inspected wallet without an implant.
- The records track reported hardware findings rather than total theft victims or proof of compromised inventory at every named retailer.
Mark Karpelès has launched a public database tracking hardware implants and counterfeit Ledger wallets, bringing scattered photographs, purchase accounts and researcher findings into a single public record of the supply-chain investigation.
The former Mt. Gox chief announced the project on October 14, saying it catalogs implants he has examined and confirmed from public reports and images. By CoinScreamer’s review on October 15, the database listed 15 devices: 12 labeled as having confirmed implants, two counterfeits and one inspected device with no implant found.
Those are the project’s evidence classifications. They do not establish 12 theft victims, a total loss figure or the number of affected wallets still in circulation. CoinScreamer has reviewed the public records but has not physically examined the listed devices.
Mark Karpelès announces a public reference database of Ledger implants documented through public reports and photographs.
A Record of Devices, Sellers and Physical Evidence
The site, called Ledger Implant OSINT, organizes entries by wallet model, reported seller and location, publication date and finding. Individual pages add photographs, source links and, where available, markings on extra circuit boards or antennas.
Nano X, Flex and Stax devices appear among the implant reports. The counterfeit entries concern Nano S Plus devices, a separate category from genuine wallets modified with additional electronics.
Nine named sellers or marketplaces appear in the current list, including MediaMarkt, Challenger, Metapod, CryptoBilis, Amazon Japan, Yahoo! Flea Market, Lazada, Ozon and JD.com. Some records do not identify a seller. The Amazon entry specifically describes a third-party seller, rather than attributing the sale to Amazon itself.
The names provide purchase context. They do not prove that a retailer installed an implant, knowingly supplied altered stock or has a compromised inventory across all locations. A public report about one unit needs to retain that scope.
Why the Russian Case and the Clean Device Matter
One Russian entry concerns a Nano X reportedly bought through Ozon. The record describes an extra board and antenna and links photographs shared through Reddit and X.
Its provenance notes also explain a potential mix-up: photographs circulated by another user are attributed to the Russian buyer’s device, rather than a wallet that user bought at MediaMarkt in Trier. The database separately records the Trier device as having no implant found.
Including a clean comparison helps readers distinguish a suspicious modification from an ordinary device layout. It also shows why images circulating in several posts cannot automatically be counted as several affected wallets.
For the wider investigation, the useful contribution is traceability. Readers can follow each record back to its published evidence and see which details are documented, missing or dependent on someone else’s account.
Researchers’ Findings and Ledger’s Confirmation Remain Separate
Ledger’s October 13 update said its confirmed incidents remained confined to Southeast Asia and that it had not verified a drain linked to a device bought elsewhere. It asked resellers and distributors in six Southeast Asian countries and Hong Kong to suspend sales while the investigation continued.
The company also said it had no indication that its infrastructure, systems, services or direct sales channel had been compromised. Our sales-pause coverage explains the geographic scope of that request.
Karpelès’s broader device list and Ledger’s statement address different evidence. A researcher can identify added hardware in photographs or a teardown without the manufacturer having verified a corresponding theft. Neither establishes the point in the distribution chain where every device was altered.
CoinScreamer previously covered Karpelès’s airport inspection, which concerned an unused Flex submitted for examination. Our company-confirmation report separately examined Ledger’s finding of an implant in an affected customer’s device.
Genuine Hardware Can Still Be Physically Modified
Ledger Donjon’s threat model explains that Genuine Check authenticates the secure element. It cannot detect unauthorized physical modifications, including spying implants, when the original secure element remains intact.
That is why modified genuine devices and counterfeits belong in different categories. Authentication of one security component does not verify the physical integrity of the entire device or every stage of its journey to the buyer.
Earlier research describes implants intercepting recovery words through the display connection, avoiding the need to extract a private key from the secure chip. Our warning timeline traces that work and its disclosure history.
The database accepts additional cases through a GitHub submission form, with links to public reports. Its count is a snapshot that can change as evidence is added or clarified, while attribution and the full scale of any associated thefts remain unresolved.
Disclaimer: CoinScreamer is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and market insights on digital assets and related technologies. NuvexMedia LLC invests in and collaborates with companies across the digital asset, blockchain, and technology sectors. These relationships do not influence CoinScreamer’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2025 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
