Comment by Derelicte

Ledger devices generate a private key internally, and it never leaves the device's secure element chip. The malicious chip in this attack reads the display to get the 24 word recovery phrase shown during setup.

These Ledger hardware wallets are following the best security practices for hardware wallets and still got hacked.