Where the foam padding behind a Ledger Nano X screen should be: a microcontroller with its markings scraped off, a Nordic cellular modem, an eSIM and a custom antenna. It's wired into the lines that carry data to the screen. When setup shows your 24 words, it reads them and sends them to the attacker over its own mobile connection. It never goes near the secure chip, so the device passes the genuine check. Ledger's own docs say the check can't detect this.

Ungovernable

$93M Drained From Tampered Ledger Devices

A weekly news show informing you on the latest in Bitcoin, privacy and open source tech, hosted by Ungovernables, Max and Q. AOB KeyOS v1.4.1 relea...