UPDATE: Ledger says its investigation found a “highly organized criminal group” spent months buying genuine devices, installing hidden tech to capture recovery phrases, and reinserting them into the supply chain.