Crypto thieves sell hardware wallets with secret eSIM

“The Ledger Nano X is the most secure way to manage your cryptocurrency,” advertises the French company Ledger, its hardware wallet for cryptocurrencies. Nevertheless, users have lost around 100 million US dollars in cryptocurrencies. This is because unknown individuals have succeeded in intercepting and manipulating the offline wallets while on the go.

Each Ledger Nano X has a Secure Element chip that controls a tiny touchscreen. Ledger praises this as particularly secure. Unfortunately, this only applies if attackers cannot read the screen. This is exactly what the perpetrators are doing. They insert additional hardware into apparently genuine Ledger Nano X and then sell them to unsuspecting crypto speculators.

If buyers use such a modified hardware wallet and create a seed phrase with it, the attackers automatically read along. They haven’t touched the Secure Element chip at all; it remains secure. Instead, they have installed an additional chip that intercepts the transmission from the Secure Element to the built-in screen and recognizes the displayed letters of the seed phrase – embedded Tempest. This is indicated by an analysis by Tibane Labs.

Recognizing the characters alone doesn’t help the perpetrators yet, because the wallets fundamentally work offline. So the perpetrators have also installed an LTE modem, a tiny eSIM module, and a small antenna, all powered by the accumulator already built into the hardware wallet. Thus, the seed phrase is transmitted via mobile phone to the perpetrators, who thus gain control over the cryptocurrency assets secured by the seed phrase.