推文

@dafangbigfang · 2026-10-12 08:53

At five in the morning, I was still helping a viewer investigate the suspected theft of assets from his Ledger Stax wallet. Daylight had arrived, but I couldn’t stop thinking about the message he sent me: “Brother, I really want to die. What am I going to do about the loans?” Reading that, this became far more than a story about wallet security. I want to find out what happened, and I want him to hold on. We can keep looking for ways to deal with the money. His life has to come first. The viewer told me he had purchased a Ledger hardware wallet in Malaysia and discovered unauthorized transfers of BTC, ETH and USDT on October 9. According to him, the assets involved were worth nearly $500,000. The exact loss still needs to be checked against the on-chain records and prices at the time. He joined a call on my channel and agreed to make our conversation public. I began helping him organize his purchase records, the wallet initialization process, how he stored his recovery phrase, and the transactions showing funds moving from exchanges into his wallet and subsequently out of it. Initially, I considered many of the usual explanations. Had he photographed the recovery phrase? Stored it on a phone, computer or cloud service? Entered it into a website or an app? Signed a malicious approval? Could someone else have accessed his backup? These questions needed answers. “I never exposed my recovery phrase” alone does not establish where things went wrong. As our conversation continued, however, I learned that he had previously lost more than a million yuan because of problems involving a hot wallet and recovery phrase storage. According to his account, that experience led him to study self-custody seriously, switch to a hardware wallet, choose the expensive Ledger Stax, and become much more careful about generating and storing his recovery phrase. He said that this time, he had never photographed it, uploaded it online or shared it with anyone. These remain his statements and still require verification. But I could no longer casually explain his experience by saying, “He must have exposed his recovery phrase again.” He also told me he had found CryptoBilis through the reseller listings on Ledger’s official website. The materials he provided also point to this Malaysian retailer. I asked him to preserve screenshots of the official reseller page, purchase receipts, payment records and complete conversations as soon as possible. These records matter because they help establish where the device came from, when it was delivered and its condition at delivery. A consumer buying through a channel listed on a brand’s official website has good reason to believe that channel is trustworthy. We then began tracing the funds. BTC, ETH and USDT need to be examined separately, with addresses, transaction hashes and timestamps matched across the relevant networks. For USDT in particular, we need to look beyond transfers and examine contract approvals, token movements initiated through contracts, and any changes to TRON account permissions. On-chain records can help establish when funds left, where they went and whether they moved again. They do not directly reveal where or how the private keys were exposed. Meanwhile, public developments were emerging in the broader CryptoBilis incident. Ledger stated that at least one affected device contained an unauthorized hardware implant. Researchers also published a Nano X teardown analysis showing additional circuitry and a cellular communications module. That changed the direction of the investigation. The security of the physical device throughout delivery and distribution needed close examination. One issue is easy to overlook: even if a recovery phrase is generated by a genuine device, and even if its owner never photographs it or stores it online, added hardware capable of stealing information could undermine those precautions. Whether the same attack mechanism applies to this viewer’s Stax requires separate verification. Different models have different displays, circuitry and internal designs. Finding a communications module does not establish the complete attack process. In the early hours of the morning, I received new Stax teardown photographs. They show what appears to be an additional circuit board, with module markings identifying an nRF9151 cellular communications chip. This is an important lead that deserves further investigation. But the photographs still need to be connected to the physical device, purchase records and custody history. The hardware also needs to be compared with the original design, with its connections and firmware behavior examined to establish whether it read or transmitted sensitive information. For that reason, I am not currently describing this as “the first confirmed case of theft through a hardware implant in a Stax.” Whether the device was modified before sale, who modified it and how that modification caused the loss all require evidence. A device already containing an implant when sold and one modified after delivery raise very different questions of responsibility. Establishing that timeline is essential. I also want to explain my position on Ledger. I have unboxed nearly all of its major products, including the Nano X, Stax and Flex. I appreciate some of its hardware wallet designs and have also discussed its recovery phrase backup solutions. So far, I have found no unauthorized transfers or losses in my own wallets created using recovery phrases generated by Ledger devices. That describes my personal experience only. My channel’s purchasing advice has remained consistent: for devices that hold private keys, I choose to buy directly from the manufacturer. Third-party channels, including authorized resellers, are outside my personal purchasing choices. That is a way to reduce the risks associated with additional distribution steps. It does not justify blaming consumers who buy through official reseller channels, and buying directly does not eliminate every risk. This incident is a major test for Ledger. If the investigation establishes that consumers bought devices through an officially listed reseller and those devices had already been implanted before delivery, the brand needs to address channel oversight, device handling, the scope of affected products and how victims will be supported. Whether the original hardware design contains a vulnerability is only one part of the issue. Consumers also place their trust in the purchasing channels listed on the official website. Specific legal liability depends on the evidence, contracts and applicable local law. In my view, however, the brand has a responsibility to provide consumers with a clear, verifiable explanation and meaningful action. I will do what I can to help this viewer organize evidence, report the case to Ledger and prepare materials for a local police report. Any developments concerning the recovery of funds should be supported by confirmation from the relevant authorities or platforms. I will not make promises I cannot deliver. I am helping him without charge because I want to understand what happened. Someone who had already paid a painful price and worked hard to learn how to protect his assets has suffered another loss. Where did things go wrong this time? I also hope people with knowledge of hardware, on-chain tracing or local reporting procedures can contribute evidence-based leads and suggestions. Please do not use this incident to sell “paid recovery” services to the victim, or ask him for his recovery phrase or private keys. If you have had a similar experience, you can message me privately. I will obtain your consent before making any conversation public. The detailed on-chain tracing and video explanation are being prepared. I will clearly distinguish confirmed facts, the viewer’s account and conclusions that still require verification. Trust takes years to build, yet can be shaken overnight. Those who once placed their confidence in you are now waiting for answers. Whether that trust can be restored depends on the actions that follow. 凌晨五点，我还在陪一位观众调查他的 Ledger Stax 资产疑似被盗的事情。天亮了，最让我放不下的，是他发来的那句话： “老哥，我真的想死了，贷款怎么办？” 看到这里，这件事对我来说，已经远远超出了一个钱包安全选题。我希望能把原因查清楚，也希望他先撑住。钱的事情可以继续想办法，人一定要留下来。这位观众告诉我，他在马来西亚购买了 Ledger 硬件钱包，10月9日发现 BTC、ETH 和 USDT 出现未经本人同意的转出，涉及资产按他的说法接近50万美元。具体损失金额，还需要按链上记录和当时价格继续核对。他接受了我频道的连线，也同意公开我们的对话。我开始帮他整理购买凭证、初始化过程、助记词保管方式，以及资金从交易所转入钱包、再被转出的记录。刚开始，我其实怀疑过很多常见原因。助记词有没有拍照？有没有保存在手机、电脑或者云盘？有没有输入过某个网站或软件？是不是误签了授权？有没有其他人接触过备份？这些都需要问清楚。仅仅一句“我没有泄露助记词”，还不足以确定问题出在哪里。但随着对话深入，我了解到，他之前已经因为热钱包和助记词保管问题，经历过一次上百万元的损失。按照他的讲述，那次教训之后，他认真学习了自托管，改用硬件钱包，选择了价格很高的 Ledger Stax，也更加谨慎地处理助记词生成和保管。他表示，这一次没有给助记词拍照、上传网络或提供给他人。这些目前仍是他的陈述，我还需要继续核实。但我已经不能轻率地用一句“又是自己泄露了助记词”来解释他的遭遇。尤其是，他告诉我，购买渠道是通过 Ledger 官网找到的经销商 CryptoBilis。他提供的材料也指向这家马来西亚商家。我提醒他，尽快保存官网经销商页面、购买凭证、付款记录和完整聊天记录。这些材料关系到设备从哪里来、什么时候交付，以及交付时是什么状态。一个消费者通过品牌官网列出的渠道购买产品，有充分理由相信，这条渠道值得信任。随后，我们开始追踪资金。 BTC、ETH、USDT 要分开核对，不同网络上的地址、交易哈希和时间也必须对应起来。尤其是 USDT，不能只看“转账”两个字，还要检查合约授权、代币被调用转走，以及 TRON 账户权限有没有发生变化。链上记录可以帮助我们确认资金何时转出、流向哪里、后续有没有继续移动。但它不会直接告诉我们，私钥究竟是在什么环节泄露的。与此同时，CryptoBilis 相关事件已经出现公开进展。 Ledger 表示，至少一台受害设备存在未经授权的硬件植入。研究者也公布了 Nano X 的拆机分析，展示了额外电路和蜂窝通信模块。这让调查方向发生了变化：设备本身在交付和流通过程中的安全，必须认真检查。这里有一个容易被忽略的问题。即使助记词由真正的设备生成，即使用户没有拍照、没有联网保存，如果设备里被加入了能够窃取信息的硬件，用户的谨慎也可能被绕过。至于这位观众使用的 Stax，能不能套用 Nano X 的攻击原理，需要另外验证。不同型号的屏幕、线路和内部设计都有差异，不能看到一个通信模块，就认定完整攻击过程已经查清楚。直到凌晨，我收到了新的 Stax 拆机照片。照片里可以看到疑似额外电路板，模块标识涉及 nRF9151 蜂窝通信芯片。这是值得进一步调查的重要线索。但照片仍然需要与实物、购买记录和设备保管过程对应起来，也需要与原厂结构比较，确认线路连接、固件行为，以及它有没有读取和发送敏感信息。因此，我目前不会把这件事写成“首例已经证实的 Stax 植入盗币”。这台设备是不是在售出前就被篡改、由谁篡改、篡改如何导致资产损失，都需要证据。售出时已经存在植入，与交付后遭到篡改，责任判断会有很大差别。这个时间点必须查清楚。我也想说明自己对 Ledger 的态度。我几乎开箱过他们所有主要产品，包括 Nano X、Stax 和 Flex。我认可他们在硬件钱包上的一些设计，也讨论过他们的助记词备份方案。我自己由 Ledger 设备生成助记词所建立的钱包，截至目前没有发现异常转出或资产损失。这只能说明我的个人使用情况。我频道长期以来的购买建议也没有改变：涉及保管私钥的设备，我会选择品牌官方直购，第三方渠道，包括授权经销商，都不在我个人的选择范围内。这是一种减少流通环节风险的选择，不能据此责怪通过官方经销渠道购买的消费者，也不能保证官方直购就消除了所有风险。这次事件，是对 Ledger 的一次重大考验。如果调查证实，消费者通过官网列出的授权渠道，买到了在交付前就被植入硬件的设备，那么品牌需要回应的，就包括渠道管理、设备流转、受影响范围，以及受害者后续如何得到处理。 “原厂设计是否存在漏洞”只是其中一个问题。消费者信任的，还包括官网列出的购买渠道。具体法律责任，需要根据证据、合同和当地法律判断。但在我看来，品牌有责任给消费者一个清楚、可核实的解释，以及实际的处理行动。我会尽可能协助这位观众整理证据、向 Ledger 报备案件，并为当地报案准备材料。任何追回资金的进展，都应当以相关机构或平台的确认作为依据，我不会给他无法兑现的保证。我愿意无偿帮他，是因为我想知道：一个已经付出过惨痛代价、努力学习安全保管资产的人，这一次究竟在哪个环节出了问题？也希望了解硬件、链上追踪或当地报案流程的朋友，能够提供有依据的线索和建议。请不要借这件事向受害者兜售“付费追回”，也不要索取他的助记词或私钥。如果你有类似经历，可以私信我。涉及公开对话，我会事先征得你的同意。详细的链上追踪和影片讲解正在整理中。已确认的事实、当事人的陈述和仍待验证的推论，我会分别讲清楚。信任建立起来需要很多年，动摇却可能只在一夜之间。那些曾经放心托付的人，如今都在等一个交代。失去的信任能否挽回，就看接下来拿出怎样的行动。

曝光 9202 · 评论 6 · 点赞 33 · 书签 12 · 曝光/时 32.348652799881656