Security researchers revealed that sophisticated spy implants installed in Ledger hardware wallets have facilitated approximately $100 million in thefts. The malware, described as requiring months of R&D, intercepts 24-word seed phrases and exfiltrates them via embedded eSIM modules. One implant was discovered in a Ledger Flex unit purchased through an authorized reseller in Singapore, raising concerns about supply chain integrity across distribution networks including European retailers like MediaMarkt and Aqipa. SEAL 911 investigator Jonty identified the drain patterns through victim reports, leading to collaboration with Tether to freeze $10 million in stolen USDT. Despite the successful freeze, recovery efforts are expected to take years due to the complexity of tracing laundered funds. Researchers demonstrated physical inspection techniques for Nano X devices to detect tampering, while debating whether the breach originated from specific distributors such as CryptoBilis or broader unauthorized modifications within the reseller channel.