OK, a physical implant seems to be the leading possibility, and I think Mark's October 8 post warning about this might have caused the attacker to begin the drain today. This would pass the Ledger Live "Genuine Check" since the actual board and secure element are real, and Ledger can't detect spying implants. You wouldn't need a crazy secure element exploit for this. And cellular closes the exfiltration route question (Mark showed that these spy-implanted Ledgers have SIM cards in them with active data plans) So the attackers are sitting there farming freshly generated seeds, waiting for the right moment to strike (if you start draining, everyone gets alerted). Probably a good moment to strike is when a post about physically modified Ledgers with SIM cards in them gets 75,000 views... Many things still up in the air, but I'd bet on this being the vector: a specific vendor selling Ledgers with physical spy implants, bypassing the Genuine Check, spying on seeds, and doing a mass drain after seeing Mark's warning getting traction.