Reverse Engineering A Ledger Nano X Hardware Implant
summary
A secondhand Ledger Nano X contains a hidden green PCB with wires and an antenna that taps the SPI link between the secure element and display, captures the 24‑word recovery seed (logged as 26 A–Z glyphs during setup), stores it in flash and sends it over a cellular IoT modem. Firmware dump reveals an ARM Cortex‑M with SWD left enabled, 32 KB flash, and a module ID showing EC716S / Air 700E plus an embedded eSIM that connects to public LTE, enabling remote exfiltration. Buy only from authorized resellers and inspect shrinkwrap.
AI-written summary · about
chapters (7)
- 0:00Introduction and background
- 5:23Hardware espionage overview
- 13:37Hardware implants explained
- 21:02Ledger Nano X hardware implant
- 30:11Reverse engineering the implant
- 40:27Firmware analysis and recovery seed theft
- 43:57Ledger’s response and future work
related talks
38mExtracting Seeds from Hardware Wallets
13mWallet Direct Connectivity
43mZondax HW wallet support: from 0 to Hero
40mKeeping secrets in your opponent's hands
40mBiohacking: The Invisible Threat
27mReverse Engineering Custom ASICs By Exploiting Supply-Chain Leaks
43mThe Misuse Of Secure Components In Hardware Wallets
01h 46mTutorial: Introduction to Reverse Engineering