A spare circuit board, soldered beneath the screen, read the 24 words as they appeared on the screen during the first dozen or so seconds after startup. It sent them out over a mobile network.
The wallets were genuine. The secure chips were intact, and they passed Ledger’s own authenticity check. That check verifies the chip, not whatever else has been slipped inside the casing.
The breach happened in distribution. CryptoBilis, a Southeast Asian distributor covering Indonesia, Malaysia, and the Philippines, was involved. On October 10, Ledger confirmed that a user had taken a device apart and found something inside that shouldn’t have been there.
The money started disappearing in batches on October 9.
Blockchain analytics firm Bitquery counted 324 wallets across six chains, with losses totaling around $102 million. Tron was hit hardest, with $79.3 million, most of it funds swapped into USDT. On Bitcoin, the on-chain losses were $16.8 million.
The method didn’t look like someone stealing from wallets one by one. Bitquery saw 25 Tron wallets authorize the same address within three seconds, followed by $29 million being withdrawn. The permissions on another 30 wallets were changed, and $5.8 million was taken. This looks more like a batch operation.
Tether reacted quickly, freezing $10 million USDT across 20 addresses and blacklisting 37.
Frozen doesn’t mean returned. The rest of the money moved even faster: $20 million USDT was bridged to Ethereum, $23.7 million was swapped into USDD, which Tether can’t freeze, and then routed through THORChain back into ETH. Over four days, about 6,680 ETH went into Tornado Cash.
My assessment is that the security model of hardware wallets protects the chip, but not the casing. For twenty years, the industry has locked down the cryptographic side, while the distribution side has relied on dealers to do the right thing.
Ledger still hasn’t disclosed the total losses or how many devices were tampered with. The company also hasn’t said at which point in the distribution chain the devices were switched.
Trezor’s response says even more. A few days ago, its head of business, Danny Sanders, sent an open letter announcing that a number of authorized resellers would be cut off, effective January 1 next year. New inventory would stop shipping immediately, and existing stock could only be sold off during Black Friday and the holiday season. The letter said, “There is no evidence that Trezor devices have been compromised.”
That statement from Sanders doesn’t line up with what hardware hacker Joe Grand said. In August, he also found implants in two Trezor devices: one One and one Model T, sourced respectively from Facebook Marketplace in Canada and a TikTok shop. One buyer discovered that $50 was missing from their account. Both devices came through unauthorized channels, so Trezor isn’t technically wrong—it just hasn’t told the whole story. I’m not sure how to judge that; it wouldn’t be fair to say they deliberately hid it.
If you really want to protect yourself, the steps are simple. Don’t buy devices through reseller channels. Generate a new recovery phrase on a new device, and abandon the old one entirely.
$BTC $ETH $TRX #币安广场 #硬件钱包 #Ledger #SelfCustody