Every confirmed fund loss in the recent Ledger security incident has been traced to hardware wallets sold by retailer CryptoBilis. Ledger's Donjon security team determined that compromised devices contained an unauthorized add-on component installed prior to sale. The malicious hardware decoded recovery phrases directly from the device setup screen and exfiltrated the sensitive data via an embedded eSIM. This supply chain attack allowed attackers to intercept seed phrases during initial configuration, leading to direct theft of user funds.