Mark Karpeles (마크 카펠레스), former chief executive of Mt Gox, has started developing a low-cost detector that can check whether a Ledger hardware cryptocurrency wallet has had malicious components inserted. The move comes as concerns grow about supply-chain security for hardware wallets after a component capable of stealing recovery phrases was found in a tampered Ledger wallet.

On Oct. 18, blockchain outlet U.Today reported that Karpeles recently disclosed on X, formerly Twitter, plans to develop a detector that can check for unauthorized electronic components inside a wallet without taking it apart.

Karpeles asked, "Is my Ledger safe? Is there a spy implant inside?" He said he is devising a device that would allow users to check for malicious hardware components without opening the device themselves.

The detector is expected to use low-power wireless signals and resonance tests to detect whether an unauthorized antenna component is inside the wallet. The core is to identify the characteristics of internal parts from outside to determine the possibility of device tampering.

Karpeles also plans to keep production costs low so that ordinary users can use it without 부담. He also suggested publishing printed circuit board design files and technical specifications so users can make it themselves. If development proceeds as planned, it could provide a way to conduct an initial check for wallet tampering without specialized equipment or dismantling the device.

No working detector has been made public yet. Independent performance verification has also not been conducted. Further verification is needed, including how accurately it can find malicious parts and whether it could mistake normal parts for tampered ones. It is therefore difficult to view the device alone as fully guaranteeing wallet safety.

The development plan is drawing attention as it coincides with a recent controversy over tampered Ledger wallets distributed through resellers in Southeast Asia. Attackers were reported to have obtained genuine hardware wallets, inserted secret electronic components inside, and redistributed the tampered products to the market.

Ledger's security team said the component was designed to collect the 24-word recovery phrase during the wallet initialization process. The recovery phrase is key information needed to access the cryptocurrency stored in the wallet. If leaked to an attacker, there is a risk of assets being stolen even without taking the device itself.

The component was reported to have been able to connect to the LTE network using the wallet's internal eSIM and transmit the collected information to an external attacker. Independent researchers estimated cryptocurrency losses from the incident at more than $90 million.

Ledger said in an official statement on Oct. 15 that its security chip, operating system and servers were not hacked. The company explained that the cause of the incident was criminals obtaining its products during the distribution process and then tampering with the hardware. It emphasized that the issue was device tampering after the distribution stage, not a breach of the manufacturer's internal systems.

It also tightened distribution policies to prevent a recurrence. Ledger said it would strengthen rules for approved resellers and ban the resale of returned products. It is also pursuing steps to keep products off open display shelves until they are purchased. The aim is to reduce the likelihood of outsiders accessing devices during distribution and lower the risk of hardware tampering.

Karpeles' detector development is seen as an attempt to provide a defensive tool for users to check devices directly, in addition to security management by manufacturers and distributors. Hardware wallets are used to securely store private keys, but if products are tampered with during distribution, software security alone may make it difficult to prevent the risk.

Ultimately, the detector's effectiveness depends on the release of an actual device and third-party verification. If it can accurately find malicious parts at low cost, it could change how hardware wallet users conduct security checks, but it should be assessed as an experimental response until specific performance is confirmed.