Why the Theft of $100 Million From Ledgers Took 'Months of Research and Development'

Ledger hardware wallets sold through authorized resellers in Southeast Asia were allegedly compromised by hidden implants that captured 24-word seed phrases during setup and transmitted them over a mobile connection. The host and guests said the thefts appear to have been in development for months, with evidence of smaller drains as early as September 8 and a bigger wave on October 9 that drew wider attention.

A guest from a crypto security incident-response group said victim reports first revealed the pattern, and on-chain analysis showed the stolen funds were larger than the amounts initially reported, suggesting more victims than the ones who came forward. Another guest described the technical design of the implant: a board inserted into the wallet, monitoring the screen, recording each seed word, and sending the data out through an eSIM.

The discussion focused on whether CryptoBilis, the reseller most associated with the wave, was the source of the compromise. The guests said that remains unconfirmed, especially because other authorized resellers in Southeast Asia also appear to have sold tampered devices, including a Ledger Flex bought in Singapore. They argued the attack likely involved a sophisticated supply-chain operation requiring significant research, testing, and funding.