Someone took away about 91 million US dollars at once. 203 BTC were deposited into two addresses in the same block, and in the same hour, approximately $58 million worth of USDT on the market also moved. The money was taken from a batch of Ledger hardware wallets, and the mnemonic words were already sent out on the day the user turned on the device. Someone opened a Ledger bought from Malaysia and found a small board with eSIM under the screen. @MagicalTux sent out photos of the disassembly on October 8th. The LTE module is soldered onto that small board, and I don't usually do anything but stare at the screen. When you activated it and copied the 24 mnemonic words one by one, the words had already been sent along the mobile network. Ledger Live's own genuine verification cannot be found, the Ledger chip in the machine is genuine, and the dirty thing is under the screen. I enlarged that set of photos for a long time, and the solder joints are not as neat as workshop goods. There is a store in Malaysia called CryptoBilis that sells hardware wallets. Ledger's official website has listed it as an authorized dealer in Malaysia, Indonesia, and the Philippines since at least 2022. A legitimate store, selling genuine goods, has been doing business honestly for several years. But in March of this year, the founding team sold the entire company. The transaction also comes with a confidentiality agreement, and the original shareholders are not allowed to disclose the change of ownership of the company to the public before October 19th. As of August this year, there is only one person in the company registration information who holds 100% of the shares, named Jiaming, with a registered address in Heilongjiang. The store is open, the website is up, the domain name has not been changed, and the "Ledger Authorization" brand is still in place. The former co-founder later said that the old team cannot even access the company's backend. Next is the unboxing post on October 8th, which received 120000 views. 22 hours after the post was posted, the person holding onto those mnemonic words collected everything that should have been collected. About 7 hours after the transfer, Ledger came out and said he was investigating, requesting CryptoBilis to suspend sales and shipments. Yesterday, Ledger confirmed that there was indeed unauthorized hardware implantation in the victim's device. So far, no one has officially matched the new shareholders with the tampered machines, and Ledger has not said how these boards were inserted into the machines. But here's the road: don't crack the security chip, don't gnaw on the firmware, just buy an authorized sign, ride on someone else's three-year reputation to ship, make the machine call outside on its own, and clear it all at once when the disassembly post is released. The brand "Authorized Dealer" was recognized by the group of people who opened this store in 2022. The company changed its owner in March, but the brand still remains in place. Until today, no one has rechecked who it changed to.