Ledger states the chip is a power-management IC with no bus access to the secure element, meaning it cannot sign transactions or read seed material. The company attributes the $92M in losses to Ledger Connect Kit supply-chain incidents, phishing kits, and users entering seed phrases into Ledger Live-lookalike sites — not to anything on the board.
The editorial argues the physical finding and the financial losses are almost certainly unrelated, but Ledger's three years of opacity — especially since the 2023 Ledger Recover rollout — make it impossible for users to distinguish benign auxiliary components from a real threat. The 'boring board around the secure element' is a claim, not a proof, when schematics aren't public.
By surfacing the crypto.news story to HN with a framing that links the hidden chip directly to the $92M theft claims, the submitter treats undocumented components as a structural red flag. The implicit argument: hardware wallets sell a verifiable-attack-surface promise, and auxiliary components omitted from public BOMs undermine that promise whether or not they are exploitable.
Ledger, the French hardware-wallet maker that ships roughly 7 million devices worldwide, has confirmed the presence of an undocumented secondary chip on its wallet boards after independent researchers posted teardown photos showing silicon that wasn't on any public BOM. The disclosure came in a terse engineering note after days of pressure on X and Reddit, where the discovery collided with a separate wave of theft reports — users claiming a cumulative $92M drained from Ledger-connected addresses over the past quarter.
Ledger's position: the chip is a power-management IC with no bus access to the secure element that holds private keys. It cannot sign transactions, cannot read seed material, and was omitted from marketing diagrams because, per the company, auxiliary components typically are. The theft claims, Ledger argues, trace to Ledger Connect Kit supply-chain incidents, phishing kits, and the long tail of users who typed seed phrases into Ledger Live-lookalike websites — not to anything on the board itself.
The physical finding and the financial losses are almost certainly unrelated, but Ledger has spent three years making it structurally impossible for users to tell the difference. Since the 2023 Ledger Recover rollout — the firmware feature that could, in principle, shard and export a seed to third-party custodians — the company's threat model has been under a microscope. An undocumented chip, however benign, is the exact shape of the thing that community has been scanning for.
Hardware wallets sell a specific promise: the secure element is a black box you don't have to trust the vendor about, because the attack surface is small enough to reason about end-to-end. That promise quietly depends on the board around the secure element being boring — and "boring" is a claim, not a proof, when the schematics aren't public. Ledger's secure element (an ST33 variant) is itself closed silicon under NDA; the firmware is partially open but the SE blob is not. Add an undocumented neighbor chip and the trust surface widens from "trust STMicro and Ledger's firmware team" to "trust STMicro, Ledger's firmware team, and whatever that other thing is doing on the same PCB."
Compare the reaction to how the community handled the Trezor Model T's STM32 — also not formally certified as a secure element, also well-understood because the schematics are public and the firmware is fully open-source. When Trezor's security model is criticized, the criticism is specific: side-channel attacks on an unprotected MCU, documented and bounded. Ledger's criticism is diffuse by design: nobody outside the company can produce a bounded list of what the device can do, so every new discovery feels like it could be the one that matters.
The $92M figure deserves scrutiny too. Chain-analytics firms tracking the claims — Arkham, ZachXBT's working list — attribute the overwhelming majority to the December 2023 Connect Kit compromise aftermath and ongoing address-poisoning scams, neither of which require any wallet-side vulnerability. The headline conflation ("hidden chip + $92M theft") is doing most of the narrative work, and it's doing it unfairly. But Ledger owns the conflation: when your disclosure posture is "we'll tell you what matters," users will decide for themselves what matters, and they'll pick the scariest frame available.
The deeper industry pattern here is one practitioners have seen in every closed-silicon security story from Intel ME to the Apple Secure Enclave to Pluton: vendor-defined threat models work until the first surprise, after which they never work again. Intel ME was "just a management engine" until Positive Technologies demonstrated otherwise. The TPM 2.0 spec was "formally verified enough" until the voltage-glitching papers landed. Ledger's chip almost certainly is what they say it is. The problem is that "almost certainly" compounds badly across a seven-year ownership window on a device holding your retirement.
If you're holding non-trivial crypto on a hardware wallet, nothing in this week's disclosure changes the recommended posture, but it should sharpen it. Treat your hardware wallet as a signing device, not a vault — the vault is your seed phrase, offline, in a form the device cannot touch after setup. Use passphrase (the 25th word) for anything above a threshold you'd feel in your gut if it vanished. Assume the device firmware is adversarial for amounts above that threshold and verify transaction details on a second independent surface (an air-gapped machine, a second wallet from a different vendor cross-checking the destination address).
For engineers building anything that touches hardware security — not just crypto, but FIDO keys, HSMs, TPM-backed attestation, confidential compute — the operational lesson is about disclosure hygiene, not silicon. Document every component on your board, including the ones that "obviously don't matter," because the cost of the eventual disclosure is proportional to how surprised your users are. Ledger didn't lie about the power-management chip; they just didn't mention it, and the gap between "didn't mention" and "hid" is a gap users will not grant you after the fact. Public BOMs, public board photos with annotated callouts, and third-party teardown programs cost almost nothing and remove an entire category of future crisis.
For teams evaluating hardware security vendors — procurement in regulated industries, especially — this is a reminder that "certified secure element" (CC EAL5+, FIPS 140-3) says nothing about the rest of the board. The certifications bound a chip; your attackers target a product. Ask for full schematics under NDA, ask for the component-level BOM, and ask what the vendor's response time is on a surprise teardown finding. A vendor who can answer "here's our public BOM, here's the teardown we commissioned ourselves" has already done the work.
The hidden-chip story will fade within a news cycle; the structural issue it exposed will not. Expect the open-source hardware wallet camp — Trezor, Keystone, the Foundation Passport, and whatever Jade iterations Blockstream ships next — to lean hard into "every component documented" as a differentiator, and expect Ledger to respond with a more detailed public board annotation sometime in Q1. The underlying tension — closed secure elements have real security advantages, but closed anything-else has none — isn't going anywhere. The vendors who treat full documentation as a feature rather than a liability will own the next five years of this market.
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.