Reverse engineering a Ledger Nano X hardware implant

Writing on core-jmp.org, oxfemale walks through Joe Grand’s HARDWEAR.IO 2026 talk in Santa Clara, where Grand tore down a real hardware implant found inside a counterfeit Ledger Nano X. The unit came from a Lazada seller in Thailand and surfaced in an August 2025 Reddit post.

The implant doesn’t touch the Secure Element. It sits next to it. When the wallet displays the 24 BIP-39 recovery words, those glyphs cross the OLED’s SPI bus in the clear. An unmarked 3×3 mm Cortex-M0+ watches that bus, template-matches the letters against a glyph table, writes the seed to flash at offset 0x7000, and a Luat Air700E LTE module with a Vodafone NL data eSIM sends it out over the cellular network.

To make room, the attacker swapped in a 70 mAh cell, replaced the battery NTC thermistor with a fixed 10k resistor, and bypassed the fuel gauge so the device always reads 100 percent full. Grand identified the eSIM with a PC/SC reader and PySim, and dumped the MCU firmware over SWD. New iterations of the implant had already been spotted by the time of the talk.

See the video below and more at core-jmp.org.

from Adafruit Industries – Makers, hackers, artists, designers and engineers! https://ift.tt/nb2ojJV
via IFTTT