SlowMist analyzes Ledger's suspected hardware implant attack: malicious module may steal mnemonic phrases via screen data cables.

SlowMist Security’s Chief Information Security Officer 23pds published an article stating that if the modification of a Ledger device’s printed circuit board (PCB) is exactly as described by former Mt. Gox CEO Mark Karpelès, the attacker would have a very high level of technical proficiency. The attack process would likely unfold as follows: The wallet generates a mnemonic phrase within its Secure Element (SE), then displays it on the screen for the user to copy. The malicious module retrieves the displayed content via screen data lines such as SPI, records the full mnemonic, and transmits the data to the attacker via LTE/eSIM, resulting in the theft of the user’s assets. The Secure Element is designed to prevent direct reading or export of private keys, but cannot block external modules from accessing information shown on the screen. However, this analysis is based on the premise that the PCB was indeed modified in the described manner; the relevant attack path and hardware implantation details remain to be independently verified. BlockBeats reported yesterday that former Mt. Gox CEO Mark Karpelès published a post disclosing that a Ledger hardware wallet he received was suspected to have a spy module implanted. The device originated from Malaysia, its outer packaging shrink wrap was intact, and no abnormalities were immediately apparent after opening; the implant was hidden in the position of the screen’s original cushion. Karpelès further explained that the module includes an LTE communication component, antenna, eSIM, and a microcontroller connected to Ledger’s SPI bus, which can analyze characters displayed to the user and send relevant data once the mnemonic phrase is set up.