SlowMist security researcher 23pds analyzed a compromised Ledger device purchased by Mark Karpelès that contained a spy module with an embedded SIM card in the screen padding. The malicious module could intercept and transmit mnemonic phrases displayed on screen via LTE, bypassing the secure element's protection of private keys.