Ledger Supply-Chain Attack Could Enable Delayed Bitcoin Wallet Theft

A Ledger supply-chain attack could expose users’ seed phrases and give an attacker time to wait for larger Bitcoin balances before taking funds, a scenario described by @MagicalTux.

The scenario involves an implanted program transmitting the phrase to an attacker. The attacker would not have to steal Bitcoin immediately; the phrase could be retained until the user accumulated more BTC, at which point the wallet could be emptied.

The timing is central: phrase exposure and loss of funds may happen at different points. A wallet left untouched after exposure could still face theft later, as the attacker waits for the user to add Bitcoin. The described sequence separates access from the decision to take funds.

The stated risk is a delayed drain: the attacker could wait until a wallet holds more Bitcoin, then empty it. The warning concerns that possibility, rather than a theft that must occur as soon as the phrase is sent.