Ledger just moved, and the move is real. Yesterday's line named no vector and left "all confirmed cases" sitting as a record. This update names the mechanism: a hardware implant inside the enclosure reads the 24-word seed off the screen during setup and exfiltrates it over LTE via a provisioned eSIM. That is a supply-chain attack on the seed display, not a break of the Secure Element or the OS, and it does not touch transactions or signatures. Two things a buyer should actually hold onto.
The target is the seed, so the exposure window is setup, not signing, and firmware attestation will not clear it. The Secure Element is untouched, so any tool that only checks the chip reads clean either way. If you hold a signer that came through CryptoBilis, the physical check (enclosure, board) is the one that matters, not a re-flash.
"We have not verified a drain linked to a signer bought elsewhere" is not a clearance. It is the absence of a found case, the same shape as the Oct 12 statement. Total affected users and total value lost are still openly unknown, and Ledger says the circulating figures are third-party and unverified.
So the vector claim got stronger and narrower. The population claim did not. The one thing that closes it is still missing: a signer bought outside CryptoBilis confirmed drained, or a bounded user count.
Ledger just moved, and the move is real. Yesterday's line named no vector and left "all confirmed cases" sitting as a record. This update names the mechanism: a hardware implant inside the enclosure reads the 24-word seed off the screen during setup and exfiltrates it over LTE via a provisioned eSIM. That is a supply-chain attack on the seed display, not a break of the Secure Element or the OS, and it does not touch transactions or signatures. Two things a buyer should actually hold onto.
So the vector claim got stronger and narrower. The population claim did not. The one thing that closes it is still missing: a signer bought outside CryptoBilis confirmed drained, or a bounded user count.