Ledger Nano X debug interface enabled supply-chain attacks (Kraken)
Who is affected
A Nano X tampered with before first use could act as a keyboard on the owner's computer or hide transactions from the screen. Ledger states the Secure Element and user secrets were not affected and that firmware 1.2.4-2 fixes the issue.
What happened
Kraken Security Labs found that the debug interfaces (JTAG/SWD) of the Ledger Nano X’s non-secure STM32WB55 microcontroller, which handles USB and Bluetooth, were left enabled until the first app was installed. An attacker who handled the device before the owner, for example in shipping or through a malicious reseller, could reflash that chip. Kraken reports that neither the device nor Ledger Live showed signs of tampering.
Kraken described two proofs of concept. In “Bad Ledger”, the modified firmware made the device act as a USB keyboard and send keystrokes to the connected computer. In “Blind Ledger”, it turned off the screen while the device kept accepting input, so that with social engineering a user could be led to approve a transaction they could not see. Kraken states the attacks could lead to loss or theft of funds.
Ledger’s bulletin LSB-013 states that the Secure Element, its code and user secrets were not affected, and that the attacks cannot be performed once an app has been installed. Ledger states that firmware 1.2.4-2 makes the Secure Element check the integrity of the whole MCU at each boot, as on the Nano S, and that debug interfaces are disabled on newly manufactured devices.
Kraken reports it disclosed the details to Ledger on 9 April 2020. Kraken’s write-up and Ledger’s firmware update were released on 8 July 2020; the bulletin is dated 9 July 2020.
What Ledger advises:
- Install firmware 1.2.4-2 or later through Ledger Live.
- Do not press the device’s buttons when a website asks you to while the screen is off.
Bluetooth Connectivity enables wireless communication between devices, like hardware wallets and smartphones, using Bluetooth or Bluetooth Low Energy (BLE) for secure data transfer.
Read full definitionLedger Live is a software application that manages cryptocurrency assets and interacts with Ledger hardware wallets for secure transactions and portfolio management.
Read full definitionFirmware is the software that runs on a hardware wallet itself: it generates keys, shows transaction details on the screen and signs.
Read full definitionA phishing attack tricks crypto users into revealing private keys, seed phrases, or login details via fake emails, websites, or messages mimicking legitimate wallets or exchanges.
Read full definitionA secure element is a tamper-resistant chip built to store secrets and resist physical attacks such as side-channel analysis and fault injection.
Read full definitionFirmware Update installs new low-level software on a hardware wallet to fix bugs, enhance security, or add features in cryptocurrency devices.
Read full definitionSources
Independent reporting and research this entry was checked against.
- Kraken — Kraken Security Labs Identifies Supply Chain Attacks Against Ledger Nano X Wallets (8 Jul 2020)
- Ledger Donjon — Ledger Security Bulletin LSB-013: JTAG/SWD protocols enabled on STM32WB55 unsecured processor (9 Jul 2020)
- Cointelegraph — Kraken Discovers Potential Attacks Against Ledger Wallets, User Funds Unaffected (8 Jul 2020)
Learn more
Guides on protecting yourself against this type of incident (Hardware attack) and the glossary terms that describe it.
Can Hardware Wallets Be Hacked?
Hardware wallets are extremely secure, but not invincible. Understand the real risks and attack vectors.
Read GuideEvil Maid Attack: Protecting Unattended Hardware Wallets
Someone accesses your wallet while you are away. Hotel rooms, offices, shared spaces — how to detect and prevent physical tampering.
Read GuideProtecting Your Hardware Wallet from Physical Theft
What happens if someone steals your hardware wallet? How to set up layers of protection so theft alone cannot compromise your crypto.
Read GuideFault Injection
Fault injection disturbs a chip's voltage, clock or electromagnetic environment so that it skips a security check or leaks data.
Side-Channel Attack
A side-channel attack in cryptocurrency and blockchain targets indirect information, like power usage or timing, to extract sensitive data from a system or device.
Secure Element
A secure element is a tamper-resistant chip built to store secrets and resist physical attacks such as side-channel analysis and fault injection.
Evil Maid Attack
An evil maid attack is a physical security threat where an attacker gains temporary unsupervised access to a hardware wallet to tamper with it, install malicious firmware, or extract private keys.
Cite this entry
WalletInsights. “Ledger Nano X debug interface enabled supply-chain attacks (Kraken)”. Hardware wallet security incident tracker. Last verified November 3, 2026. https://walletinsights.io/en/security-incidents/ledger-nano-x-debug-interface-supply-chain-attacks-2020/
Corrections and right of reply
Vendors, researchers and readers can send corrections or statements to security@walletinsights.io. We check them against the sources, update the entry and record the change in its log.
All Ledger incidents
- Hardware implants in Ledger devices sold by CryptoBilis
- Ledger Ethereum app clear-signing bypass hid all but one operation of a large batch
- Ledger Ethereum app swap flow could sign a token approval in place of a payment
- Ledger Secure SDK flaw let a host change transaction details after on-screen review
- Ledger Monero app exposed Keccak state, letting a compromised host recover spend keys