Attackers purchased genuine Ledger hardware wallets, installed concealed components capable of capturing recovery phrases, and redistributed the modified devices through resellers. The implants monitored the wallets’ displays during initialization and transmitted captured recovery phrases through cellular connections. Attackers subsequently derived users’ private keys and drained their cryptocurrency holdings. Ledger confirmed that its Secure Element, operating system, and internal infrastructure were not compromised