[HELP! URGENT!] Compromised Ledger Nano X That *Passed* “Genuine Check” Drained $214,186 - How Is This Even Possible!?

Background

A while back (November 26, 2024), I helped my less tech-savvy friend set up a brand-new Ledger Nano X. It was sealed, appeared legit, and we activated it on his MacBook using Ledger Live right in front of my eyes. First thing: I ran Ledger’s “Genuine Check.” It said the device was genuine — no issues. Then we updated to the latest firmware — no problems there either. Ledger Live application message was bright and clear: device is safe to use. r/ledgerwallet we can provide serial number of the device at any time and you surely can verify the check record.

UPD3: Many people have asked if we reported this incident to Ledger. Of course we did. My friend submitted a support case to Ledger at the same time I finished my original post. So far, we haven’t received any response from them.

We also spent around eight hours at our local police station (see reports below). Our next step is heading to a larger town nearby that has its own cybercrime unit. We’ve also filed online reports with the FBI and the Cyber Crime Unit of Israel (my friend is a citizen of that country).

I’ll update this post if we get any new information from Ledger or from the legal authorities.

Police report

UPD4: Even though I explained multiple times in the main post why a compromised device is more likely than a simple seed phrase leak, some people keep pointing to seed leaks. In the meantime, thanks to a few helpful comments, I found even more suspicious Lazada stores like these:

It’s overwhelming how many shops are selling only Ledger Nano X and Nano S models, trying to look like legitimate Ledger resellers. Some commenters suggested these might be “stolen” devices, but that doesn’t entirely make sense—if they were simply stolen but still working correctly, customers wouldn’t necessarily be scammed. There must be another motive—like tampering.

As of now, we still haven’t heard back from Ledger. The police have asked us not to touch the compromised device. However, I’m going to order one of these suspect devices myself, break it open, and see what’s inside. I’ll film the entire process, from placing the order to activating the device, and then update everyone with my findings.

UPD: As many people started to ask. During setup we generated a brand-new seed phrase. Moreover, not just once, but twice. First, I just showed my friend how it works, and we did it together. And then, since I was watching, we wiped out everything, and he did it again from scratch, writing down the seed phrase without me watching. Both times, Ledger's "Genuine Check" was green.

UPD2: Community asked for the device photo with the "Genuine Check", here it is:

Ledger \"Genuine\" check

I also understand skepticism about leaked seed phrase. As I said myself initially - that was my first guess. This theory stops as soon as one sees the shop he bought it at. Mimicked as "Ledger Thailand" with fake reviews and removed (now) products. This process goes on right now and can still be seen here

Lazada fake sellers

Fast forward to about a week ago, my friend finally started using the wallet to receive funds (both ETH and TRX). Suddenly, just a few hours ago, he discovered everything — $214,186 worth — was gone. ETH gone. TRX gone. My first suspicion was that my friend must’ve leaked the seed phrase or compromised it somehow. But he swears he stored it safely, and he hadn’t even touched the physical Ledger since setting it up and receiving those funds.

The Discovery: A Fake Ledger Store

Then came the bombshell: my friend bought this Nano X from a Thai e-commerce site, Lazada, at what appeared to be a store called “Ledger Thailand.”

Storefront

Transaction

Lazada is like the Amazon of Southeast Asia. They do have legit Ledger resellers (like SIAMBC), but it looks like these scammers created an entire fake “Ledger Thailand” store.

Bottom line: This device was almost certainly compromised from the start, yet it still passed Ledger’s own “Genuine Check.” That’s terrifying. At no point did Ledger’s software give us any warning. There’s no mention on Ledger’s “Loss of Funds” page about this possibility. There’s no big warning that the “Genuine Check” might fail to detect a tampered device. Including Reddit community. It’s downright misleading to call it a “Genuine Check” if it can’t catch something like this.

Transaction Details & Hacker’s Trail

I’ve traced as many transactions as possible. I’m pleading with r/ledgerwallet, r/Tether (funds are still in USDT), r/OKX (hacker seems to use your exchange and wallet extensively) and the broader crypto community to help freeze the funds and assist with any possible recovery. Here’s what we know:

Victim wallets:

All funds were drained to:

Hacker’s real wallet: 0x644Dc17e70A46130203feADfA75C31d49aCddDc1

Specific drain transactions:

  1. ETH:
  2. TRX:

From there, the attacker:

Moved USDT to ETH mainnet at (From TRX via OKX Bridge):

https://etherscan.io/address/0x220348EfB98Ea10DC3dE5237E7F1855017f5B7D8

Swapped to BTC via THORChain:

https://thorchain.net/tx/0xe029c87e98d03a9c4d03f885d7555784ddbe0b0eaa69001195b75edc28970c24

BTC briefly landed at:

https://www.blockchain.com/explorer/addresses/btc/bc1p6ytcmqm43hyc54dtlgsqyjrqp9sl42l7vr4mxlm52grzngt8hp7q0ywrup

Then more BTC transactions:

e90bb17ee1c307583e4339da3f3856270b59618aefc31a69a1e8ae4ce6449dc9

9a2f935aa571b095f93f0d97e787ad8f678ab06aab40e238858d86d29d624747

Finally, sent the BTC back to ETH mainnet:

https://thorchain.net/address/bc1p4x47v40agw53z6zkaj7np7ue8dtjj5c6tu5ydj7v99q26yq4pncsy2mdnp

Important: The final wallet still holds the stolen funds, some set aside in a separate address:
https://etherscan.io/tx/0xd1014ad59e5b712ed89af1c542374b8207669591744e200a26b38b8c5dc6054d

The ultimate destination seems to be the hacker’s “real” wallet. He’s been actively using it for years and interacts with multiple CEXes from there:

Call to Action

  1. r/ledgerwallet: How can a tampered or fake device pass the “Genuine Check”? Why isn’t this risk clearly spelled out on your Loss of Funds page? This is a massive trust issue.
  2. r/Tether, r/OKX and any other exchanges: Please help by freezing or flagging these funds if you see them — $214K is life-changing money, and it was stolen in such a brazen way.
  3. Community: If anyone has tips, contacts at exchanges, or knows someone who can push this further, please help. Sharing or upvoting this post so that more eyes see it could make a difference.

TL;DR

  • Friend bought what appeared to be a brand-new Ledger Nano X from a fake “Ledger Thailand” Lazada store.
  • Device passed Ledger’s Genuine Check but was actually compromised.
  • $214,186 drained from ETH and TRX wallets derived from the compromised seed.
  • Funds were moved through ETH/TRX, then bridged, swapped for BTC, and back to ETH again.
  • Everything currently sits in a long-time, active hacker wallet with possible CEX interactions.

Please, everyone — be extremely careful when buying hardware wallets. Only buy from official sources. And Ledger, if you see this, we need answers ASAP. My friend (and I) are desperate to get these funds frozen and hopefully recovered.

Any help or signal boost could be huge right now. Thank you!