Ledger Donjon reported that hardware implants found in CryptoBilis-sold Ledger devices use a microcontroller to decode screen data during setup, capturing 24-word recovery phrases and transmitting them over LTE using a provisioned eSIM

From the articleMediaMarktSaturn Removes Ledger Hardware Wallets as Tampering Reports ExpandAlso in Ledger Spy Implant Scandal Prompts Mediamarkt Sales Freeze, Ledger confirms hardware implant in CryptoBilis reseller units as MediaMarkt suspends sales in Europe, MediaMarktSaturn Pulls Ledger Wallets From Sale in Europe as Spyware Claims Spread, MediaMarktSaturn halts Ledger sales amid spyware concerns