Ledger confirmed that the devices sold by CryptoBilis (a Southeast Asian authorized distributor) were subject to hardware implant attacks. The estimated loss on the blockchain was $86-93M.
The attackers installed circuit boards and LTE modules below the screen to intercept the mnemonic phrases and transmit them back; approximately 98-311 wallets were stolen, with an average loss of $890K per wallet; Ledger suspended the sales of CryptoBilis, and Tether had frozen the involved USDT.
Impact: The "private key not leaving the device" model of hardware wallets has been physically bypassed; unlike the Coldcard firmware vulnerability (5200 wallet dispersion), this case focuses on the distributor level and involves high single transaction amounts; the risk of trust chain in the self-hosted supply chain has escalated.
Source: The Verge + Decrypt + CoinDesk + https://t.co/tfoxDShCYf News + TokenPost + FinWire + InsideBitcoins (Ledger officially confirmed on October 10)
The free project offers an active BTC address for you to participate in earning points, which can be exchanged for platform currency. There might be short sellers involved, but you can still give it a try.