Mnemonic phrase wasn’t leaked, hardware wallet wasn’t connected to external devices, yet Ledger users lost over $93 million overnight. Current investigations point to Southeast Asian authorized distributor CryptoBilis. The company quietly changed ownership earlier, and some devices were reportedly suspected of having spy modules capable of reading mnemonic phrases. Attackers started testing transactions as early as late September, seemingly planning weeks in advance.