Thomas Karpelès says a Ledger Flex bought at an airport came with more than he paid for: a spy implant tucked inside the device. The buyer has been identified as Ben Yorke, and the retailer that sold the compromised unit was Metapod, according to Karpelès. Ledger, for its part, says its own investigation into verified fund losses keeps pointing back to wallets sold by CryptoBilis — not to devices bought at airports.
The two claims don't cancel each other out. They're about different things: one is an alleged hardware compromise at the point of sale, the other is where Ledger says the money actually went missing in cases it has verified.
What Karpelès says was inside the Flex
Karpelès's claim is narrow and specific. A Ledger Flex — one of the company's newer touchscreen models — was purchased from an airport seller. Somewhere in that chain, an implant got added. He names Yorke as the buyer and Metapod as the retailer that moved the unit.
That's the whole of it, at least from what's been disclosed. There's no breakdown of what the implant was built to do, no timeline for when it might have been inserted, and no word on how many other devices from the same seller might be affected. Airport retail is a strange channel for a security product to pass through — quick turnover, transient customers, and no obvious way for a buyer to verify a sealed box against a tampered one.
The detail that matters most for anyone holding a Ledger isn't the specific unit. It's the question of whether this was a one-off or a pattern. Right now, nobody has answered that.
Ledger's side: CryptoBilis, not airports
Ledger's statement draws a hard line. In its investigation, the verified fund losses remain tied to wallets sold by CryptoBilis. That's the company's position, and it doesn't budge toward the airport story.
Read carefully, that's not a denial that a compromised Flex existed. It's a separation of two tracks. Verified losses — the cases Ledger has actually traced money through — run through CryptoBilis wallets. The airport device is a separate allegation, and Ledger isn't folding it into its loss numbers.
For users, the practical takeaway is this: if you're trying to figure out whether your funds are at risk, Ledger is telling you to look at where your wallet came from, not just what device you plugged in. The two aren't the same question, and conflating them is how people end up chasing the wrong lead.
The gap neither side has closed
Metapod sold the device. Yorke bought it. Karpelès reported the implant. Ledger says verified losses trace to CryptoBilis. Four names, two narratives, and no public reconciliation between them yet.
The obvious unresolved question is whether the airport sale channel and the CryptoBilis wallet channel intersect at all. Nobody has said they do. Nobody has said they don't, either. Without that link — or a clear statement that there isn't one — the two stories sit side by side, each true on its own terms, each incomplete on its own.
Watch for two things. First, whether Ledger expands its statement beyond the CryptoBilis line — specifically, whether it addresses the airport device directly rather than by contrast. Second, whether Metapod or anyone in the airport retail chain responds to the implant claim, and whether the affected unit turns out to be isolated.
Until one of those happens, the only solid facts on the table are these: a Ledger Flex bought at an airport allegedly had an implant, a man named Ben Yorke bought it, Metapod sold it, and Ledger's verified losses still run through CryptoBilis. Everything else is still open.
