The Screen Was Listening: Cellular Implants Inside Resold Ledgers
Where the foam padding behind a Ledger Nano X screen should sit, tampered units bought through a Southeast Asian reseller carried a scraped microcontroller, a cellular modem and a custom antenna wired straight into the display lines.
A cryptographic attestation check can prove that a secure element is genuine, and still say nothing about what is reading the screen over its shoulder. Across Thursday and Friday, engineers and freedom-tech researchers dissected a hardware supply-chain attack against Ledger Nano X devices acquired through a reseller in Southeast Asia, in which organized criminals replaced internal foam with an independent radio transmitter.
Ungovernable laid out the anatomy of the implant in detail: Where the foam padding behind a Ledger Nano X screen should be: a microcontroller with its markings scraped off, a Nordic cellular modem, an eSIM and a custom antenna. It's wired into the lines that carry data to the screen. When setup shows your 24 words, it reads them and sends them to the attacker over its own mobile connection.
Because the tap sits on the display bus rather than inside the enclave, the cryptographic handshake with the host software proceeds normally. It never goes near the secure chip, so the device passes the genuine check. Ledger's own docs say the check can't detect this.
Ungovernable noted. In its 142nd Financial Freedom Report, the Human Rights Foundation (HRF) confirmed that the tampered devices were sold through a Southeast Asian reseller and noted that an on-chain investigator estimates losses above $86 million, while Ungovernable's brief put the drained total at $93 million.
The lesson echoed a line Fedi posted from Imagine IF earlier in the window: A customer list is a target list — the only list that doesn't leak is the one you never collect.
And elsewhere on the security beat, Marcel and Nate marked a passage from a Malwarebytes report on how a single credential opened nearly nine million personal records: A weak, leaked password opened an authorized route into a sensitive register. That access allowed millions of searches, and the activity was discovered only after an unusually large bill drew attention to it.
As Nate's second highlight noted, TV 2 says an email containing the password 123456 had appeared in a larger data leak
—while Mr.Crown // Renarchy pointed to 6.39 million personal records compromised in an earlier Odido breach.
