Reverse Engineering a Ledger Nano X Hardware Implant

Executive Summary

A hardware wallet is sold as a steel door for cryptocurrency: the seed that unlocks the coins is supposed to live only inside a Secure Element, never on a phone, never on a laptop. In August 2025 a Reddit buyer in Thailand opened a cheap Ledger Nano X from a Lazada seller and found something that did not belong there. Hardware hacker Joe Grand (Kingpin) acquired a specimen, opened it, and in May 2026 walked HARDWEAR.IO Santa Clara through a complete reverse-engineering of the add-on board glued into the case.

The implant does not crack the Secure Element. It sits beside it. When the wallet shows the 24 BIP-39 recovery words on its OLED, those glyphs travel in the clear over SPI. The unmarked Cortex-M0+ watches that bus, template-matches letters, stores the phrase at flash offset 0x7000, and a Luat Air700E LTE modem with a Vodafone NL “DATA ONLY” eSIM sends the words out over the cellular network. Battery chemistry, the NTC thermistor and the fuel gauge were all rewritten so the device still looks full and healthy. This article walks the 78-slide talk in source order, keeps every dump and photograph, and then adds kitchen-table explanation, operator hunting notes, and later public reporting from October 2026 that is not part of Grand’s May talk.

The talk, the speaker, and the public files

Joe Grand is a hardware hacker, electrical engineer, and former member of the L0pht. The HARDWEAR.IO USA 2026 abstract puts the problem in one sentence: hardware espionage is discussed constantly and seen in the wild almost never. This specimen is the rare case that can be put on a bench, photographed, probed, and dumped.

Grand Idea Studio published the revised 29 May 2026 slides, the conference video, and a zip of firmware pulled from the implant MCU. This article does not re-host that firmware binary. Operators who need the dump should take it from the author: ledger_hardware_implant_fw.zip.

First contact: a Nano X that was too cheap

The trail starts in August 2025. A Reddit post describes a Nano X bought on Lazada from a Thailand seller using a Ledger-looking name. The buyer wanted the battery. The price was wrong. The colour was wrong. The seller let them keep the unit after a colour complaint. The closing line is the whole threat model: these things are already in the wild.

Hardware espionage is a supply-chain problem

The point of this section is not theatre. A Secure Element, a locked bootloader and a signed firmware image all assume the bill of materials you think you bought is the bill of materials that arrived. An extra QFN, an extra modem and a shorter battery sit outside those checks. Andrew Huang’s 2019 BlueHat IL talk “Supply Chain Security: If I were a Nation State” is the slide Grand uses as the historical pointer: every logistics hop is a place someone can add a part.

Precedent: fake Trezors and the 2020 Ledger USB stick

Before the Nano X add-on board, two public cases already showed that “hardware wallet” is not a synonym for “untamperable”.

Trezor One and Model T: swap the MCU, freeze the seed

That attack is a replacement. The legitimate MCU is gone. The user still thinks they own a Trezor; the entropy they believe they generated was chosen by the vendor of the clone. Kaspersky documented the campaign; Trezor published buyer guidance. Grand shows both product photos because the cosmetic shell is doing most of the social-engineering work.

• Kaspersky: fake-trezor-hardware-crypto-wallet/48155
• Trezor: stay-safe-shopping-for-hardware-wallets

What an implant is, versus a clone

The Ledger specimen is this second class. The genuine Secure Element, the genuine OLED and the genuine USB stack still run. The attacker added a parasite that listens to a bus the genuine design never treated as a secret.

Ledger Nano X, 2020: a USB stick on the test points

That 2020 campaign used the wallet as a Trojan horse for a computer payload: open the case, solder a USB stick onto debug pads, mail it to an address from a leaked list, and steal the seed when the victim connects the device to a PC. The 2025–2026 implant is quieter. It does not need the PC. It has its own radio.

• Reddit: r/ledgerwallet o154gz
• BleepingComputer: criminals mailing altered Ledger devices

Acquisition and teardown

Grand does not spend the talk on chain-of-custody theatre. The next slides are the unit on the bench: yellow plastic shell, USB-C, OLED, and then the moment the case comes apart and the extra green board is obvious.

The money shot is the yellow case shell with a green add-on board still glued in place, a 70 mAh pouch cell on the genuine Nano X PCB, and a tangle of enamel wire. The implant board is marked V05. Adhesive remover and a syringe are in frame because this was not a press-fit module; it was bonded into the housing.

Hardware reverse engineering

Grand anchors the legitimate architecture in Ledger’s own Nano X Security Target v1.2 before showing what was added. That document is how an evaluator is supposed to think about the product: Secure Element, MCU, OLED, battery gauge, USB. Anything that is not in the Security Target and is soldered into the case is in scope for this talk.

Front side: steal volume from the battery, lie to the fuel gauge

Three physical lies, one purpose: make room and keep the UI calm. A 70 mAh cell is much smaller than the stock pack, which is how a 3×3 mm MCU, an LTE modem, an eSIM and a coil fit in a shell that was never designed for them. The original pack uses an NTC thermistor so the charger can refuse to run if the cell is frozen or overheated. A fixed 10 kΩ resistor tells the gauge “I am 25 °C forever.” Bypassing the fuel-gauge sense path so the device always reports 100 % means the victim never asks why a brand-new Nano X dies in an afternoon.

Back side: OLED SPI and the implant MCU

RF: an 8 cm coil near 937 MHz

A quarter-wave at 937 MHz is about 8 cm of wire. That is GSM-900 / LTE band neighbourhood, which matches a cellular modem far better than a Bluetooth LE coil. Grand is explicit that the HackRF pass is a hunt, not a finished demodulation: identify that the implant radiates, then move to the modem documentation and the eSIM.

OLED: the secret travels on SPI

This is the architectural punchline. The Secure Element will not give you the seed over USB. It will send bitmap traffic to a display so a human can write the words down. That traffic is SPI. SPI on a hardware wallet is almost never encrypted, because the original threat model was “the case is closed and the attacker is on the other side of USB.” An implant inside the case is on the inside of that assumption.

USB: BOOT pin, three CDC-ACM ports, one RNDIS

The USB personality is the fingerprint of a Luat Air700E cellular module, not of a Ledger. OpenLuat’s Air700E documentation is the slide Grand leaves on screen as the decoder ring: CDC-ACM for AT / PPP, RNDIS for a USB Ethernet gadget, a BOOT pin that holds a bootloader, and debug UARTs that will show up in the next section.

MCU: unmarked QFN-20, Cortex-M0+, SWD

Scraped or never-marked MCUs are a supply-chain cliché because they work. A 3×3 mm Cortex-M0+ has more than enough flash to hold a glyph table and a 24-word buffer. Identification then becomes electrical: find SWD, read the CPUID, dump the image, and stop caring about the silkscreen.

UART banner: EiGENCOM D-Fota, 22 January 2024

The debug UART is a gift. It names the firmware family (EiGENCOM D-Fota), the version (2.5), the build wall-clock (22 January 2024, 17:20:56), a 40-byte blob, a missing parameter 0x5846, and a flash XIP limit at 0x809978 before the module continues into a normal boot. That is more attribution than most implants ever print.

(E) Welcome to EiGENCOM D-Fota Time!
 ___      _____ ___ _____ _
| _ \    | ___/ _ \_    _|/ \
|| \| -- | |_ || || | | / _ \
||_/| -- | _| ||_|| | |/ ___ \
|___/    |_|   \___/ |_/_/    \_\

(C) Copyright 2020, All Rights Reserved.
(V) Version(2.5), Built @Jan 22 2024 17:20:56

uart(0) urc baud: 115200
total length(40):
[1/1] 6a790221864850f6b5d9022194f8a221944850f6afd9944b1d78002de9d1099b002be6d0d4f87e31
no par(0x5846) found!
exit...
bootloader flashXIPLimit(0x809978), try normal boot system start!

eSIM: a Vodafone NL “DATA ONLY” identity that has been to Manila and the US

An MFF2 eSIM is a SIM card that looks like a power MOSFET: eight-lead DFN, 5×6 mm, soldered down. Electrically it is still ISO 7816. Grand adapter-boards it up to a PC/SC reader and lets PySim speak GSM files. The result is the closest thing this talk has to a campaign fingerprint.

Card info:
Name: UICC
ATR: 3b9e96801fc78031e073fe211b66d0024421150072
ICCID: 89314404001365967271
Class-Byte: 00
Select-Ctrl: 0004
AIDs: a0000000871002

IMSI (subscriber identity): 082940401738767429
MCC: 204 (Netherlands)
MNC: 04 (Vodafone NL)
MSIN: 01738767429

Service Provider Name (EF.SPN): 0044415441204F4E4C59 ("DATA ONLY")
SMS Parameters (EF.SMSP): "Vodafone"

EF.EPSLOCI -> Philippines (Smart, 515-03)
EF.LOCIGPRS -> USA (T-Mobile, 310-260)

Four boxes: antenna, MCU, eSIM, cellular modem

Once the parts have names, the implant is no longer a mysterious green PCB. It is a very small computer with a very small phone. The MCU is the brain. The Air700E is the mouth. The eSIM is the identity. The coil is the ear/mouth to the tower. Nothing in that diagram needs to defeat Ledger’s Secure Element. It only needs to sit next to the OLED.

Firmware reverse engineering: glyphs in flash, seed at 0x7000

The MCU image stores an alphabet. Each record is a word index, a length, and a payload of letter codes where 0x01 is A through 0x1A is Z. Grand’s worked example decodes to six BIP-39 words: GRAPE, SOURCE, VICIOUS, IDEA, EXPECT, SHAFT. Those words are a demonstration of the codec, not a victim seed published for reuse.

struct record {
uint8_t word;
uint8_t length;
uint8_t payload[];
};

0x01 = A, 0x02 = B, ..., 0x1A = Z

01 05 07 12 01 10 05 02 06 13 0F 15 12 03 05 03 07 16 09 03 09 0F 15 13
04 04 09 04 05 01 05 06 05 18 10 05 03 14 06 05 13 08 01 06 14

1: GRAPE
2: SOURCE
3: VICIOUS
4: IDEA
5: EXPECT
6: SHAFT
...

Final words from the May 2026 talk

Future work Grand named and did not deliver on stage

Those two bullets are a research agenda. Cellular MITM of an Air700E on a Vodafone NL M2M profile is a lab project with its own legal perimeter. This article stops where the talk stops: the radio is the exfil path, and a software-defined eNodeB is how you would watch it. There is no packet capture, no srsRAN config, and no C2 hostname in the slides.

What Ledger said, as of the talk

That guidance is still the right first advice for a buyer. It is also incomplete against an implant that keeps a genuine Secure Element: any check that only authenticates the SE will green-light an implanted unit. Grand already had that tension in May. Public reporting in October 2026 made it a headline.

Summary slide

The Ledger Nano X hardware implant exfiltrates data displayed on the screen. It monitors the OLED’s SPI bus, detects letters used in the recovery seed, transmits over 4G LTE. New iterations of implant have already been spotted.

Joe Grand, HARDWEAR.IO 2026 summary slide

Later public reporting (October 2026) — not in the May talk

Grand’s teardown is Generation 1, on stage in Santa Clara in May 2026, from a specimen whose public trail starts on Reddit in August 2025. In October 2026 a separate wave of reporting described implanted Nano X units moving through reseller channels (publicly associated with CryptoBilis), large victim drains, and a Ledger Donjon confirmation that at least one affected user’s device contained an unauthorised hardware implant. Those loss figures are not measurements from this talk. They are later context so a reader in October 2026 does not think the story ended on the thanks slide.

• Ledger’s public line after the October wave: factories, firmware and direct sales were not described as the implant insertion point; reseller / second-hand / unauthorised channels were.
• Genuine Check authenticates the Secure Element. A genuine SE inside an implanted shell still passes. That is why a software check is not a substitute for opening the case or comparing against known-good hardware.
• Independent labs (including Tibane Labs’ October field notes) described later mechanical generations that keep the original battery and hide a flex under the OLED foam. That is the “new iterations already spotted” bullet from May, arriving in public photographs.
• Mark Karpelès and others repeated the operational advice that matches the firmware: if a seed was generated or imported on an implanted unit, that seed is known to the attacker on a delay of their choosing. Move funds from a new seed on a trusted device.

What to hunt, weigh, and photograph

The talk is a teardown. Translating it into a hunting checklist is the operator extra.

Key Takeaways

• The implant is a supply-chain hardware addition (ATT&CK T1195 / T1200), not a Ledger firmware 0-day. There is no CVE in this talk.
• Collection is a cleartext SPI tap between the genuine Secure Element and the genuine OLED. The SE can be honest and the seed still leaves the device.
• Exfiltration is 4G LTE via a Luat Air700E, an MFF2 eSIM, and an 8 cm coil. USB is optional and, with BOOT low, almost silent.
• Generation 1 cheats the battery path (smaller cell, fake 10 kΩ NTC, fuel gauge stuck at 100 %) so the victim does not notice the missing volume.
• The MCU firmware is a glyph template matcher. Alphabet at 0x4D00–0x4E40, recovered phrase at 0x7000, letters coded 0x01…0x1A.
• The eSIM dump (Vodafone NL, SPN DATA ONLY, last attach in the Philippines and the US) is a campaign fingerprint, not a complete attribution.
• By May 2026 Grand had already seen new mechanical iterations. October 2026 reporting is a later, larger public chapter of the same class of device.

Defensive Recommendations

1. Buy path. Hardware wallets from the vendor or a named authorised reseller. Marketplace “new in box” listings at a discount are the insertion path this talk documents.
2. Inspect. Compare the opened device to Ledger’s known-good photographs. Generation 1 is obvious. Later generations need weight, X-ray, or a teardown of the OLED stack.
3. Do not trust Genuine Check alone. A check that authenticates the Secure Element will pass on an implanted genuine SE. Treat it as necessary, not sufficient.
4. First-setup hygiene. If a seed was ever displayed on a device with unknown custody, generate a new seed on a trusted device and move funds. The attacker can wait.
5. Vendor hardening. Case-open switches, display-bus encryption or a framebuffer MAC, a fuel-gauge that cannot be tied at 100 %, and a factory process that notices extra RF parts.
6. IR / lab. Photograph, weigh, X-ray, then dump the MFF2 with PC/SC + PySim before you kill power if you need location files. Pull SWD on the unmarked QFN for the glyph/seed image. Do not power the modem on a live tower from a sensitive site without Faraday measures.
7. Detection engineering. IOCs from this specimen: Air700E USB personality, EiGENCOM D-Fota banner dated 22 Jan 2024, ATR/ICCID/IMSI above, V05 silkscreen, 70 mAh substitute cell. Expect all of those to change on later builds; the stable behaviour is SPI-glyph-LTE.
8. Do not build a better implant. The public firmware and this codec are for recognition and defence. Re-hosting a ready-to-solder exfil gadget is out of scope.

Conclusion

Joe Grand’s HARDWEAR.IO 2026 talk is the moment a rumoured “fake Ledger” becomes a photographed, dumped, identified object: a V05 add-on board, an unmarked Cortex-M0+, a Luat Air700E, a Vodafone NL data eSIM, and firmware that reads the OLED SPI bus like a keyboard. The Secure Element is not the failure. The assumption that the rest of the plastic is empty is the failure. Anyone who handles high-value keys — operators, incident responders, and people who simply want to keep their coins — has to treat the case, the battery, the display ribbon and the purchase channel as part of the trusted computing base. The slides already said new iterations were in the wild. The months after Santa Clara showed what that sentence meant.

Original text: “Reverse Engineering a Ledger Nano X Hardware Implant” by Joe Grand aka Kingpin at HARDWEAR.IO 2026, Santa Clara (Grand Idea Studio; slides revised 29 May 2026).