Slow Mist: Ledger Hardware Wallet Suspected of Being Implanted with Spy Module That Can Capture Seed Phrases Displayed on Screen

Odaily reports that former Mt.Gox CEO Mark Karpelès stated that a Ledger hardware wallet he purchased from Malaysia was found to contain a suspicious module with a SIM card chip built in. The module was hidden in the screen padding area, and the device's outer packaging was intact.

Slow Mist Chief Information Security Officer 23pds analyzed that attackers may have connected the malicious module to the screen data cable to record the words displayed when the device generates seed phrases, and then used LTE or eSIM to transmit the data externally.

23pds pointed out that the secure element of a hardware wallet is mainly used to prevent private keys from being directly read, but it cannot prevent malicious hardware from capturing screen display content. Currently, the related attack mechanism remains a technical speculation and still awaits further verification.