Hardware Implants in Ledger Nano X Steal Seed Phrases

Researchers from Tibane Labs have discovered hardware implants in Ledger Nano X wallets designed to steal cryptographic keys.

The device is a mini-board connected to the SPI bus between the secure element and the OLED display.

The implant reads screen pixels, recognizes recovery phrase words, and transmits them via a built-in LTE/eSIM module. The secure element remains untouched, and the device successfully passes Ledger's authenticity check.

Modifications can only be detected by opening the case. Researchers described three generations of devices: from early prototypes with wires to compact black flexible boards hidden under the screen.

Later versions had factory-level assembly and original batteries, indicating preparation for mass production. Devices were found on secondary markets in Japan and Malaysia.

If you set up a Ledger Nano X purchased from a suspicious seller and saw 24 words on the screen, the wallet should be considered compromised.

You must create a new seed phrase on a trusted device and transfer all funds. The research source is available at:

• Tibane Labs Research