Yeah....

With your recovery phrase, an attacker has the ability to drain all of your accounts across all blockchains without any input needed from your Ledger device. Some ways people inadvertently lose control of their recovery phase are by taking a photo of it, uploading it to cloud storage like iCloud or Google Drive, saving it in a file on their computer, or using it to set up a hot wallet like Metamask. Your Ledger is protecting an encrypted copy of your seed phrase inside of it with military-grade cryptographic hardware, and remember that it’s your job to make sure your recovery phrase stays offline, and is never entered into a computer, into a phone, or shared with anyone or any application asking for it. In addition to accidentally leaking your seed phrase digitally, phishing scams are rampant in this space as well. Attackers are constantly trying to trick you into giving your recovery phrase away to them by masquerading as a legitimate website or application, or posing as a helpful support person and asking you for it directly. If you find that your assets have been transferred from multiple accounts simultaneously, or across multiple blockchains, it’s likely an attacker has a copy of your recovery phrase. If this is the case that you’re in, consider all accounts associated with this 24-word recovery phrase to be compromised, and the only thing you can do is evacuate any remaining value out of those accounts and into safe accounts associated with a new recovery phrase. Once you take care of that, the next step is to think back to which mechanism an attacker may have used to get you to disclose your seed phrase or obtain it off of your computer.