The attack's victims extend beyond the 90-day window mentioned by Ledger. This directly points to devices purchased previously or existing seed phrases restored on newer devices.
That was a dumb take from Ledger anyhow, what was a 90-day period supposed to mean?
Unless they had a list of clients and they somehow managed to match all complaints with a batch of products, this was just dumb.
.. could North Korea be behind this?
The chances are not zero.
Yeah, not zero, but more likely 0.0001%
While I doubt it's the case, there is one country that has a history of tampering with so-called secure devices, establishing a reseller company, and then blowing terrorist disks off!
If this had been a Middle East reseller, you could have started pointing fingers, but this is not in their interest at all.
Back to the drain, there are going to be some sad stories these days
The guy who owns those addresses, bc1qhwwe564ptmn5yjjl3u4anc0h2r052l3xn4ndy9, bc1qn7cgqfee6e3d0qgpyac8d6zq9t4yf80qkpsure they both have the same funding address and same time on previous txs is going to wake up in a nightmare, he has been acquiring coins in those since 2021 and 2022!
