Ledger confirmed that the devices sold by CryptoBilis (a Southeast Asian authorized distributor) were subject to hardware implant attacks. The estimated loss on the blockchain was $86-93M.
The attackers installed circuit boards and LTE modules below the screen to intercept the mnemonic phrases and transmit them back; approximately 98-311 wallets were stolen, with an average loss of $890K per wallet; Ledger suspended the sales of CryptoBilis, and Tether had frozen the involved USDT.
Impact: The "private key not leaving the device" model of hardware wallets has been physically bypassed; unlike the Coldcard firmware vulnerability (5200 wallet dispersion), this case focuses on the distributor level and involves high single transaction amounts; the risk of trust chain in the self-hosted supply chain has escalated.
Source: The Verge + Decrypt + CoinDesk + https://t.co/tfoxDShCYf News + TokenPost + FinWire + InsideBitcoins (Ledger officially confirmed on October 10)