Hackers act swiftly... Two days ago, the former CEO of Mt. Gox revealed that a hardware wallet may have been tampered with a data-stealing device. A Ledger hardware wallet that appears normal on the outside may internally contain a component capable of reading and transmitting the recovery seed. Mark Karpelès, former CEO of Mt. Gox, recently disclosed that a device he received from Malaysia appeared to have been modified: the shrink-wrapped packaging showed no visible signs of tampering, while a suspicious module was embedded behind the screen, in the space originally intended for cushioning—making it highly concealed. According to Karpelès’ analysis, the implanted device is equipped with an LTE communication module, an antenna, and an eSIM, connected via a microcontroller to the wallet’s SPI bus. The theft mechanism involves monitoring data sent to the screen, identifying characters displayed on it, and capturing the recovery seed during the user’s wallet initialization and seed recording process, then transmitting the stolen data via cellular networks.