Mark Karpelès

So who's making these implants? How far have they spread? And what did Ledger know before the money was gone? I'm Camila Russo, and this is The Defiant.

My guest is Mark Karpelès.

Most of you know the name.

He ran Mt. Gox, the first major Bitcoin exchange, through its collapse in 2014.

The implant was built to get at that seed phrase.

Former Mt. Gox CEO Mark Karpeles, who examined one of the Tamper devices, says it captured the screen output and button presses to work out the seed phrase, then sent it to an attacker over LTE using an eSIM.

Tibani Labs found two versions.

One swapped in a smaller battery to make room.

But it's getting real ugly out there, man.

Yeah, this was particularly scary, right? And also, one of the interesting parts about this story was Mark Karpeles, the founder of Mt.

Gox, sort of unveiling it, having discovered it himself on Ledger devices.

The attack was, and this type of attack has been known, you call it a supply chain attack.

Then, on October 8th, mark carpellis aka magical tux tweets photos of a ledger he cracked open hidden under the screen there's a little extra board with an lte modem and an e-sim it just watches the display you set up your wallet your 24 words show up and they get sent out on mobile data ledger's genuine trek doesn't catch it because the actual ledger chip is real his device came from malaysia obviously it's another disaster for hardware wallets just weeks after the cold card disaster where a cold card was not using the randomizer on their device they were instead using a backup javascript less random randomizer which someone figured out and then was able to take the money in this case according to the news that we have the information available at this time They put a small chip inside of the ledgers, then sold the ledger with the chip that would phone home when you create your wallet.

What's interesting to note, though, is that they didn't steal any of the money until after Mark Karpeles posts his dissection of the ledger.

It is unfortunate that Mark Karpeles chose to lead with need-free data on October 8th.

A more responsible critique probably could have been everyone should take their money off of ledger or some kind of an announcement to the background of the ledger boards.

He then goes on to talk about reverse engineering other things.

I don't know what the right way to disclose this is.

Everyone gets mad at everyone.

I remember years ago, they were mad at J.J., on the stage live that that he would be uh you know he would be taking down the uh information all my thing stops working every time you talk well they should say that in the manual for the road caster that stops working every time you talk anyway JJ revealed live from the stage in Paris a problem with the lightning Network and he said he wouldn't and he did anyway uh Mark carpellus in the same way reveals this hack bragging about free data I don't really agree with his uh choice of revealing money although I talked to someone else And they told me that this, again, is very on brand for Mark Karpeles.

Do you see who posted that picture on Twitter about the-

Yeah, this is Mark Karpeles, right? The, the-

[laughs] Yeah

...

Part of the deal when they bought this reseller was that, um, the old owners of the company could not disclose the sale until October.

In early October, Mark Karpeles, the former CEO of Mt. Gox, posted photos of Ledger devices he'd opened up.

Inside, under the screen, was a small circuit board that didn't belong there.

What surprised me is the order of events.