POPA ReconHow a spyware implant in Ledger cold wallets work
How a spyware implant in Ledger cold wallets work • Someone opens a real Ledger and solders a second board onto the wires between the secure chip and the screen • Original secure chip stays untouched (important: so the device can still pass Ledger's authenticity check) • The hidden malicious board has three parts: an eSIM, a small CPU, and an LTE modem • During setup, your 24-word seed is shown on the OLED screen • The extra CPU watches that screen signal, reads each 24 word as they appear and stores the full phrase • The LTE module and eSIM then send the seed out over mobile data to the attac…
The excerpt is quoted from a public Telegram channel, which owns its text.