According to Karpelès, the malicious hardware captured the device’s display output and button presses to identify the seed phrase, then transmitted it to the attacker over an LTE connection using an eSIM.