[SlowMist CISO Speculates Ledger Device Attack Path: Bypassing to Record Mnemonic Phrases Before Transmitting Externally] Foresight News reports that SlowMist Chief Information Security Officer 23pds tweeted, stating that if, as former Mt.Gox CEO Mark Karpelès suggested, the modification to the Ledger device occurred on the PCB, it would represent a highly sophisticated method. The speculated process is as follows: the seed is generated within the secure element, the mnemonic phrase is displayed on the screen, a malicious module connects to the screen data line (e.g., SPI), records the displayed words, compiles them, and then transmits them via LTE or eSIM. Once the attacker obtains the mnemonic phrase, they transfer the assets. Previously, former Mt.Gox CEO Mark Karpelès tweeted that a Ledger hardware wallet he received appeared to have been implanted with a spy module. The device originated from Malaysia, with the outer packaging's shrink wrap intact, and no anomalies were immediately apparent upon unboxing. The implant was concealed in the space originally meant for the screen's buffer pad. The module included LTE communication components, an antenna, an eSIM, and a microcontroller connected to the Ledger SPI bus. It could analyze the characters displayed to the user by the device and send the relevant data after the mnemonic phrase setup was completed. The attacker could potentially monitor the victim's wallet address and choose the timing to transfer the assets.