Former Mt. Gox chief Mark Karpelès said a sealed Ledger hardware wallet contained a hidden circuit board designed to steal the owner’s password and crypto. According to NS3.AI, Karpelès said the component could also transmit the wallet’s 24-word recovery phrase.

Ledger is investigating reports of emptied wallets involving Malaysian reseller CryptoBilis and has asked CryptoBilis to stop selling and shipping Ledger devices. Bitquery estimated losses of $92.9 million across 311 wallets, but Ledger has not confirmed those totals.

Karpelès said his device came from a different seller, and Ledger has not established that tampered hardware caused the CryptoBilis losses.