In news that will surprise absolutely no one who has ever typed "crypto" into a search bar, users of the Ledger crypto wallet are reporting drained accounts, and the culprit appears to be a reseller named CryptoBillis, a tiny spy circuit board, and the eternal human desire to trust strangers on the internet.

Ledger has asked CryptoBillis to pause all sales of its wallets while it investigates. Photos and videos posted on X and Threads show a small circuit board sandwiched under the screen. The alleged implant intercepts anything displayed on the screen - including the seed passphrase shown during initial setup - and, using an embedded SIM card, sends that information back to the attacker, who then siphons funds from user accounts. It's like a keylogger, but for your life savings.

Reports indicate the attacker has stolen over $86 million worth of crypto from hundreds of wallets. There's no indication that Ledger's systems have been compromised or that wallets purchased directly from the company have been affected. Instead, the issue appears to be a supply chain attack primarily involving users in Southeast Asia and the CryptoBillis reseller. Ledger has provided guidance on how to check if your wallet has been tampered with, which is the crypto equivalent of being told to check your parachute after you've already jumped.