quote: Yep. Not surprised this is happening somewhere in the world. We predicted stuff like this would happen in crypto back in ~2013. Pretty hard to protect against. So many steps between manufacturer and you. Shipping companies are an attack vector. Even a manufacturer’s physical store front could be compromised more cheaply than their manufacturing factories. Need auditable manufacturing (cameras recording assembly?). And need some sort of tamper-proof device supply-chain structure. Maybe a smart device case, that only the manufacturer can seal, can be cheaply verified by anyone, and any tampering breaks the seal. Like a modern wax seal. | so about the $86m ledger drain. everyone’s screaming “ledger got hacked” again. i spent the evening digging and it’s dumber and scarier than that there’s a shop in malaysia called cryptobilis that sells hardware wallets. ledger has it listed as an official authorized reseller since at least 2022, for malaysia, indonesia and the philippines. legit shop, real devices, years of normal customers this spring the founders sell it. the deal comes with an NDA: they can’t tell anyone about the sale until october 19 by august the company registry shows one owner with 100%. some guy from heilongjiang, china the shop keeps running like nothing happened. the site, the name and the “authorized by ledger” badge all stay up then on oct 8 @MagicalTux posts photos of a ledger he cracked open. hidden under the screen there’s an extra little board with an LTE modem and an eSIM. it just watches the display. you set up your wallet, your 24 words show up, and they get sent out over mobile data. ledger’s genuine check doesn’t catch it because the actual ledger chip is real. his device came from malaysia https://t.co/vRuBM0xIfR that post does 120k views 22 hours later someone sweeps everything. 203 BTC hits two addresses in literally one block. ~$58m USDT moves on tron in the same hour. i added up all the wallets: ~$91m about 7 hours after that ledger says “we’re investigating” and asks cryptobilis to pause sales cryptobilis is still on ledger’s site as an authorized reseller to be fair, nobody has officially tied the new owner to the bugged devices yet, and ledger hasn’t confirmed how it happened. but read it as a business plan: get authorized, sell real stuff for years, quietly sell the company under an NDA, keep the badge, ship devices that phone home, then drain everything the second someone notices and was ledger even told the shop got sold? nobody’s said so “authorized reseller” means ledger trusted whoever ran the shop back in 2022. says nothing about who runs it today bought your hardware wallet anywhere but the manufacturer? open it up today, ledger literally has a guide for that. then move to a fresh seed on a device bought direct wonder who’s going to answer for this: the chinese frontman from heilongjiang, the shop’s previous owners, or ledger itself @Ledger clearly needs to keep a much closer eye on who they call official resellers, and take way more responsibility for who sells their devices and how