Supply Chain Security Flaw Sparks Public Feud Between Industry Figures

A prominent figure in the cryptocurrency world has launched a scathing public critique against Ledger, a leading hardware wallet manufacturer. The criticism centers on the company's handling of a recently disclosed supply chain security vulnerability.

Core Allegation: A Gap Between Internal Knowledge and Public Action

Mark Karpelès, the former CEO of the collapsed Mt. Gox exchange, alleges that Ledger's internal teams were aware of the threat posed by a "mass-producible, self-aligning implant" targeting its hardware wallet supply chain as early as March 2026. Despite this knowledge, a clear and forceful security warning was not issued to the user base for several months afterward.

"Evidence of such an attack vector should have triggered the highest level of security response," stated Karpelès. "It's disappointing that the relevant warning appears to have been buried within an article on Ledger Academy, failing to capture the urgent attention it warranted."

Focus of Criticism: Communication Strategy and Accountability

Beyond the delayed warning, Karpelès further criticized Ledger's overall posture following the public disclosure of the incident. He accused the company of consistently "downplaying the severity" in its public statements and raised concerns about the transparency and effectiveness of its communication with potentially affected customers.

Escalation and Industry Implications

The dispute intensified following a response from Ledger's CEO, Pascal Gauthier, which referenced Karpelès' history with Mt. Gox. Karpelès fired back: "I believed you would learn from my failures and do better." This retort is widely seen as an expression of profound disappointment with Ledger's current security culture and crisis management.

This public airing of grievances has thrust the perennial issue of supply chain security in cryptocurrency hardware back into the spotlight. It prompts critical questions for the community:

  • Right to Know & Transparency: When and how should a security vendor inform its users upon discovering a potential threat?
  • Crisis Response Benchmark: What constitutes an appropriately "highest-level" response to a supply-chain-level attack?
  • Industry Trust: How can hardware wallet manufacturers, as critical guardians of asset security, build and maintain user confidence?

As of now, Ledger has not issued any further public response to Karpelès's latest allegations. The fallout from this incident is likely to influence market perceptions of hardware wallet security for the foreseeable future.