LEDGER SUPPLY CHAIN ATTACK MAY HAVE BEEN EXPOSED BEFORE MASS WALLET DRAIN Former Mt. Gox CEO Mark Karpelès may have inadvertently triggered a coordinated wallet drain after publicly exposing physically modified Ledger devices containing hidden surveillance implants. On October 8, Karpelès warned that counterfeit or tampered Ledger devices were being sold with concealed SIM cards capable of transmitting stolen seed phrases. The implants reportedly intercept data sent to the device’s screen, allowing attackers to capture recovery phrases displayed during wallet setup. Crucially, these devices can reportedly pass Ledger’s official Genuine Check because the original secure element remains intact. The verification process cannot detect unauthorized physical modifications. One theory now emerging is that attackers had been harvesting seed phrases from compromised devices, waiting to drain multiple wallets simultaneously. Karpelès’ warning reportedly attracted roughly 90,000 views, potentially alerting the attackers that their operation had been exposed and prompting them to move stolen funds. Karpelès says one compromised Ledger he examined originated in Malaysia, arrived in flawless shrink-wrap packaging, and contained an implant cleverly concealed beneath the screen. The suspected attack vector is a hardware supply chain compromise, not a cryptographic vulnerability. The connection between Karpelès’ warning and the subsequent wallet drains remains unconfirmed, as does whether the same implants were responsible. If established, the incident would demonstrate how compromised hardware can undermine self-custody even when a device passes manufacturer authentication.