Kelvin

Appearance

Language

Teardown · Ledger Stax · 2026

Ledger Stax Implant 3D Teardown

The Stax taken apart from the back, layer by layer. The implant board sits stacked directly on the main board, carrying a Nordic nRF9151 cellular module; the antenna is a flexible board stuck inside the back cover, connected back to the implant by a coax lead.

Schematic model: layout from the two buyers’ teardown photos and Karpelès Lab’s write-ups, not to scale. Chip positions on the main board and the implant board’s size are schematic.

Drag to rotate; pinch or scroll to zoom. Switch versions below to compare the stock device with the implant.

  • Implant (added by the attacker)
  • Main board → display data
  • Stock parts

From the screen to the attacker: five steps

  1. 1 · Generate

    During setup, the ST33K1M5 secure element generates the 24 words. The private key never leaves the chip.

  2. 2 · Display

    The words go through the main-board connector marked Display to the 400×670, 16-level greyscale curved E Ink screen.

  3. 3 · Tap

    The implant board is stacked on the main board, with a short flex arm ending in a small chip. How it gets at the screen content cannot be seen in the public photos; Ledger’s 10/13 summary only says the implant reads the screen.

  4. 4 · Decode

    One frame is 400×670×4 bits, about 131 KB. The other chip on the implant, a QFN, has no readable markings.

  5. 5 · Send

    The Nordic nRF9151 is an LTE-M / NB-IoT module. The antenna inside the back cover, marked AC-A2014-STAX-V1.1, connects to the implant’s u.FL through a coax lead.

Same day, same shop, orders five apart

Both are Graphite Staxes bought from CryptoBilis on 27 April 2026 for RM2,198. @DesWeb4’s invoice is order 15655, with the store’s address in Petaling Jaya, Selangor; @wentrre’s order confirmation is 15660. The orders are five apart, and both devices carried implants.

@wentrre opened his after noticing the main board had “an extra layer”. Two days later he put all the parts on a scale: 49.0 g, against Ledger’s published 44.2 g. The lot code on his nRF9151 starts 2539, which Karpelès Lab reads as week 39 of 2025.

How it differs from the Flex and Nano X

The Stax implant uses a Nordic nRF9151, the same module as Flex version A in Ledger’s own photo. Its antenna marking, AC-A2014-STAX-V1.1, follows the same AC-A2xxx naming as the Flex’s AC-A2201-FLEX and the Nano X’s AC-A2016-NANO and AC-A2205-NANO-X.

The Nano X implants are soldered to test pads on the main board; Flex version B needs no soldering, adds an extension flex and swaps in a smaller battery to make room. The Stax reports mention no battery swap: the implant board is stacked straight on the main board, which is why the buyer first saw “an extra layer”.

Every mass-produced product should be sampled

Ledger’s authenticity check only verifies the secure element, not the whole device, and implants like this leave the secure element and Ledger OS untouched, so the check cannot see them. The modification happened after the factory, so sampling has to reach the sales channels: buy units back as an ordinary customer from each channel and take them apart.

Based on these two teardowns, a sampling check would catch at least the following:

  • X-ray: an extra layer on the main board, plus an antenna and a coax lead inside the back cover, show up against a stock sample without opening the case.
  • Weight: the parts together weighed 49.0 g against a 44.2 g spec, 4.8 g more. That is one unit’s figure, not a check for ordinary users.
  • Back cover: the antenna is stuck inside the back cover, so the cover has to come off to fit it.
  • Idle current: an extra LTE module and chip draw extra power.

Special thanks

Official notes and coverage

More teardowns