Ledger Says Physical Implant in Signers Sold via CryptoBilis Drained Up to $93M

This is a supply-chain attack on hardware, not a firmware flaw, which matters because it bypasses the assumption that a signing device's screen is a trusted display. The affected population is narrow—buyers from one reseller—but the damage is concentrated, and the fact that the software was untouched means standard integrity checks would not have caught it. The open question is how Ledger and its reseller network verify physical provenance going forward, since tamper-evident packaging, not code audits, is the only layer that could have flagged this.