Former Mt.Gox CEO claims to have discovered Ledger hardware wallets implanted with spy modules, which can send mnemonic phrase information via LTE.

Former Mt. Gox CEO Mark Karpelès revealed in a post that a Ledger hardware wallet he received is suspected to have an implanted spy module. The device originated from Malaysia; its outer packaging’s heat-shrink film was intact, and anomalies were not immediately noticeable upon opening. The implant was hidden in the position of the screen’s original buffer pad. Karpelès further detailed that the module contains LTE communication components, an antenna, eSIM, and a microcontroller connected to Ledger’s SPI bus. It can analyze characters displayed on the device to users and exfiltrate relevant data after the mnemonic phrase is configured. Attackers may subsequently monitor the victim’s wallet address and transfer assets at an opportune moment. He urged users to inspect their devices in accordance with Ledger’s official guidance.