Former Mt.Gox CEO Mark Karpelès discovered a spy module containing a SIM card chip hidden in the screen padding of a Ledger device purchased from Malaysia, despite the outer packaging appearing intact. The malicious hardware was embedded directly within the device's display assembly. SlowMist CISO 23pds analyzed that the attack likely involves a malicious module connected to the screen data cable that records mnemonic phrases as they are displayed and transmits them to attackers via LTE or eSIM. While the secure element protects private keys from direct extraction, it cannot prevent interception of sensitive information shown on the screen.