Ledger Finds LTE Implant That Stole Recovery Phrases in Suspected $86M Drain

The notable part is the attack surface: compromising the display path rather than the Secure Element, which is the component hardware wallets are built to trust. That reframes the threat model from seed extraction via firmware or chips to physical supply-chain or screen-layer tampering, where existing assurances do not apply. Anyone holding a self-custody wallet bought through a reseller or handled in transit is implicated. Whether the implant traces to a manufacturing or distribution gap, and how Ledger expects users to verify a device was never intercepted, is the open question.