SlowMist: Ledger device found with spy implant stealing seed phrases via screen
- —The module intercepts screen output over SPI and records the full seed phrase
- —Data is sent to the attacker via an LTE component, antenna and eSIM
- —The Secure Element does not stop an external module from reading screen data
- —The implant was found in a device from Malaysia in place of the screen's buffer pad
Why it matters: A supply-chain attack on Ledger undermines trust in hardware wallets and could accelerate a shift to alternative self-custody solutions.
Source: ChainCatcher 链捕手