to everyone saying it's someone the nephew knew that stole the crypto, it can't be, right? because OP confirmed the thief's address had transactions from other addresses, so this seems like a remote adversary.

i'm very sorry to hear he lost $40k, especially because he was saving it for college... i can't even imagine that much money being a student so i just hope you guys can find some way to work this out... i guess.

that said, i don't think Ledger's security is to blame here... it is infinitely more likely that your nephew's computer was infected with something. for example, if he kept his trust wallet passphrase as a screenshot, perhaps that screenshot synched via iCloud to his PC, from which point the attacker was able to pick it up? or they were able to retrieve his iCloud session cookie?

there are a million times more entry vectors if you consider the PC (or, hell, Mac, or whatever it is) as the infected device. i'd wipe the shit out of it and start fresh, if your nephew intends to do anything else with crypto in the future.