Approximately $91 million was stolen in a single sweep. 203 BTC were transferred into two addresses within the same block, and during the same hour, around $58 million in USDT on the Tron network was moved. The funds originated from a batch of Ledger hardware wallets—their recovery phrases had already been transmitted the moment users powered on their devices. Someone disassembled a Ledger purchased from Malaysia and found an additional small circuit board beneath the screen, equipped with an eSIM. On October 8, @MagicalTux posted photos of the disassembled device. The board contained an LTE module that remained dormant until activated—its sole function was to monitor the screen. As you powered on the device and manually entered each of the 24 recovery words, those words were transmitted over the cellular network. Ledger Live’s built-in authenticity verification could not detect this tampering—the Ledger chip inside was genuine; the malicious component was hidden beneath the screen. I examined those photos closely for a long time—the soldering was precise, unlike something from a makeshift workshop. In Malaysia, there is a hardware wallet retailer called CryptoBilis. Ledger’s official website has listed CryptoBilis as an authorized distributor in Malaysia, Indonesia, and the Philippines since at least 2022. It was a legitimate store, selling authentic products and operating honestly for years. But in March this year, the founding team sold the entire company. The sale included a non-disclosure agreement: original shareholders were prohibited from publicly disclosing the ownership change until October 19. By August, company registration records showed only one shareholder—named Jiaming—with a registered address in Heilongjiang. The store remained open, the website unchanged, the domain unaltered, and the “Authorized Ledger” sign still displayed in place. The former co-founder later revealed that the original team could no longer access the company’s backend systems. Then came the disassembly post on October 8—viewed 120,000 times. Just 22 hours after the post went live, the individuals holding those recovery phrases collected all the stolen funds. About seven hours after the transfers, Ledger finally announced it was investigating and requested CryptoBilis suspend sales and shipments. Yesterday, Ledger confirmed that affected users’ devices indeed contained unauthorized hardware implants. To date, no one has formally linked the new owners to the compromised devices, and Ledger has not disclosed how these boards were inserted into the units. But the path is clear: rather than cracking secure chips or reverse-engineering firmware, they simply bought an already-authorized brand name, riding on three years of built-up trust to ship devices that phoned home—waiting until the disassembly post went viral to drain all accounts in one sweep. The “Authorized Distributor” label originally belonged to the team that opened the store in 2022. The company changed hands in March, yet the sign remained unchanged—and no one has since re-verified who now controls it.