Complete Chronology – Ledger / Trust Wallet Case
- Background
Around 2018: purchase of the first Ledger Nano S.
The 24-word seed was written on paper and kept in different places over time (not always the same).
After a few years, the Ledger started showing display issues.
- Preliminary Events
End of June 2025: the Ledger display became unreadable.
July 4, 2025: a new Ledger was ordered from the official website.
Attempt to restore using the paper seed → “wrong recovery” error.
Also tested on Rabby Wallet and with the Ledger Recovery tool (not Trust Wallet) → always invalid.
Conclusion: the 2018 seed had been written incorrectly or incompletely.
- Ledger Repair
Early July 2025:
A replacement display was ordered from Alibaba (generic, non-certified vendor).
A technician in Pisa (Doppio Click store) replaced the display in about 5 seconds in front of me, with the Ledger turned off.
The Ledger remained physically open and the case was not closed again to avoid damaging components.
- Transfer of Funds
Immediately after the repair:
I moved to the back of a bar room, no one else was in the bar.
I used a new iPhone (purchased at Trony, with a new Apple ID, never used before for crypto).
I installed Trust Wallet and set a PIN.
I created a new wallet and wrote down the seed only on paper.
I transferred all funds from Ledger to Trust Wallet (except ETH in staking).
Connection used: personal hotspot, not public Wi-Fi.
No backup on iCloud and no screenshot of the seed.
The Ledger and the seed were hidden in a recess of the camper where I was staying for the summer at the campsite.
- Following Days
August 4 – 13, 2025: neither the Ledger nor Trust Wallet were used.
August 14 (morning):
I decided to move the funds to a Trezor (already ordered previously).
When turning on Ledger and Trust Wallet, the funds were already gone.
- Transactions Detected
Ethereum (from Ledger)
TX: 0x8319fda9d016b48c122ed9c6f7c4164692e281737f37143680537aad742f5596
→ Funds moved to a fresh wallet, partly staked.
Bitcoin (from Trust Wallet on iPhone)
TX: 578f9054f66748ea4c65509b4d592f041c055a43c58423ede3ec8c563c1e48f1
→ Funds sent to a fresh wallet, not moved further.
Ethereum (from Trust Wallet)
TX: 0x1f2700997aaf636a8e549767cd7fbc4757f3de53004200fc7c5c02bddc636078
→ Funds moved to a fresh wallet, partly staked.
Same dynamics observed for other tokens (SHIB, CHZ, DNT, GODS, COTI, BAND, FRONT, etc.).
MANA left on Ledger (another account) were not touched.
📌 Funds were not liquidated nor transferred to exchanges or mixers.
- Subsequent Tests
In the following days, to rule out a physical attack by nearby persons:
I hid the Ledger and sent 0.035 ETH to address 0x4a33C8CC61704220624fc0282C9FfD606B9d18ca.
→ Funds were stolen the following day.
→ Shortly after, I received an incoming transaction of 0.00000477 ETH from 0xA6faF4831F6a10b4b0745e9D04B03081F53cA2da.
I made a second test: sent 0.02407094 ETH to my Ledger.
→ After a few hours, the funds were stolen again.
→ Another micro-transaction of 0.0000074 ETH followed, from the same sender address (0xA6faF4831F6a10b4b0745e9D04B03081F53cA2da).
Physical attack excluded.
Final Question
Considering the facts described above, can you help me understand what happened?
Have you ever seen similar cases?