Hidden Implants in Ledger Nano X Steal Seed Phrases

Tibane Labs researchers discovered hidden hardware implants in Ledger Nano X wallets designed to steal seed phrases.

Data Interception Mechanism

A miniature circuit board was found inside the device, embedded in the SPI bus between the secure element and the OLED display. The module reads the screen image, recognizes words from the 24-word recovery phrase, and transmits them to scammers via a built-in LTE/eSIM antenna.

The wallet's own secure element remains untouched, so the device successfully passes Ledger's Genuine Check. The modification can only be detected by physically opening the case.

Evolution of Malicious Components

The researchers described three generations of implants: from early prototypes with wires to versions with factory-quality assembly and original batteries. According to experts, the latest models were specifically designed for mass production.

The devices were purchased on the secondary market through Yahoo! Auctions in Japan and Amazon Japan, shipped from Malaysia. No direct link to reseller CryptoBilis was found, but the circumstances coincide with Ledger's ongoing investigation.

Security Measures

If you entered or viewed your seed phrase on a Ledger Nano X purchased from a questionable seller, the wallet should be considered compromised. You must create a new recovery phrase on a trusted device and transfer all funds to a new address.