Security researcher details hardware supply-chain attack: malicious eSIM/modem soldered into Ledger cold wallet intercepts seed phrase during setup and exfiltrates via LTE.
Security & Exploits ·
A security researcher has detailed a hardware supply-chain attack targeting Ledger cold wallets, in which a malicious circuit board is soldered between a device's secure chip and screen to intercept cryptocurrency seed phrases during setup. The implant, which has evolved from manual wire configurations to mass-production circuit boards designed to blend with legitimate hardware, comprises an eSIM, a small CPU, and an LTE modem. According to the analysis, the CPU firmware recognizes Ledger's on-screen font and captures all 24 words of the seed as they display; once captured, the LTE module and eSIM transmit the phrase over mobile data without requiring the device to be plugged in.
The attack preserves the original secure chip untouched, allowing the compromised device to pass Ledger's authenticity verification. This design choice means victims would likely have no technical indicator that their hardware had been compromised during the purchase or unboxing process. The malicious board operates during the critical initialization phase when the seed is first generated and displayed.
Critical unknowns remain: whether actual Ledger devices have been affected in the supply chain, how many units may have been compromised, and whether Ledger has issued any remediation or detection guidance. The vulnerability underscores the risk that even hardware-based key storage can be circumvented if devices are intercepted and modified before reaching end users.