The problems started not only with ledger cold wallets, but also with Trezor. A user from Indonesia found another card with a cellular modem in his Safe 5. Apparently she read the source phrase from the screen and passed it on to the attackers. The device was sold by the reseller CryptoBilis, through which modified ledgers were distributed in the past.