Hardware wallet maker Ledger revealed that all confirmed account draining incidents stem from devices distributed by third-party vendor CryptoBilis, highlighting supply chain risks in hardware security.