Where the foam padding behind a Ledger Nano X screen should be: a microcontroller with its markings scraped off, a Nordic cellular modem, an eSIM and a custom antenna.
It's wired into the lines that carry data to the screen. When setup shows your 24 words, it reads them and sends them to the attacker over its own mobile connection.
It never goes near the secure chip, so the device passes the genuine check. Ledger's own docs say the check can't detect this.
https://ungovernable.network/shows/bitcoin-brief/93m-drained-from-tampered-ledger-devices/
Ungovernable
npub1jc…n2890
2026-10-12 22:00:00 UTC
Author Public Key
npub1jcympy69pht7ptan39se4nd09e4q66qhey649uu3rczm2zh88c7s0n2890Published at
2026-10-12 22:00:00 UTCEvent JSON
{
"id": "2890708f39cdeeb64e7a64619da8dba3c4ae7e1958746c89f39429064640bd14",
"pubkey": "9609b093450dd7e0afb389619acdaf2e6a0d6817c93552f3911e05b50ae73e3d",
"created_at": 1791842400,
"kind": 1,
"tags": [],
"content": "Where the foam padding behind a Ledger Nano X screen should be: a microcontroller with its markings scraped off, a Nordic cellular modem, an eSIM and a custom antenna.\n\nIt's wired into the lines that carry data to the screen. When setup shows your 24 words, it reads them and sends them to the attacker over its own mobile connection.\n\nIt never goes near the secure chip, so the device passes the genuine check. Ledger's own docs say the check can't detect this.\n\nhttps://ungovernable.network/shows/bitcoin-brief/93m-drained-from-tampered-ledger-devices/\n\nhttps://video.nostr.build/aba5742657abba31cefa8491062e11f7affc27ecde56eafcb0d5894c25665867.mp4",
"sig": "c692da2789a750d0fb3336442ac0f74314029c280dbe360abe48871a293c3d4a3dfe4d1fae7d86e2c699eaf6b97383cb50827b9703971c31db23946fdc952926"
}