Ledger Supply-Chain Attackers Can Transfer Seed Phrases, Empty Wallets Later

The delayed-drain mechanic is the real story here: a compromised seed phrase turns every future deposit into an attacker's option, so the damage window extends far beyond the initial breach. That shifts the burden onto hardware-wallet vendors and their build pipelines, since users cannot audit firmware themselves. Whether the affected supply chain can be traced and whether users have any practical way to verify their devices remain the open questions.