Scammer loses $4.8M in bitcoin to tampered Ledger wallets

One of the biggest victims of the tampered Ledger hardware wallets turns out to have been a fraudster: a task-scam operator lost more than 60 BTC, worth about $4.8 million, blockchain analytics firm Chainalysis said on X on Thursday, Decrypt reported. CoinDesk put the loss at more than $4.9 million at current prices.

How the money moved

• The bitcoin came from a task scam: victims were paid small sums to post fake product sales and reviews, until a "negative balance" appeared in their accounts and they were told to deposit their own money to get paid.
• On September 22 the operator routed the proceeds through a consolidation wallet into three Ledger addresses.
• On October 9 thieves emptied all three — about $1.64 million each — into a single wallet that has been flagged as holding stolen funds.

Chainalysis did not say where the scammer bought the devices.

The wider Ledger incident

Ledger disclosed the problem on October 9. Its Donjon security team found an implant in devices sold through Southeast Asian reseller CryptoBilis that reads the 24-word recovery phrase off the screen during setup and sends it out over a mobile (LTE) connection. Ledger says every confirmed loss so far involves CryptoBilis devices. We covered the discovery in Ledger's investigation into the implanted devices.

On Tuesday Ledger asked resellers and distributors in six Southeast Asian countries and Hong Kong to suspend sales of its hardware. On-chain investigator Specter has traced more than $86 million in suspected thefts, a figure Ledger says it has not verified. The company has not confirmed how many users were affected or the total lost, and its investigation is continuing. Rival Trezor has meanwhile cut ties with some resellers.

What it means for holders

The case is an unusual twist, but the lesson for ordinary users is unchanged: a hardware wallet is only as trustworthy as its supply chain. Buy devices directly from the manufacturer or an authorised seller, never use a recovery phrase that came pre-printed or pre-filled, and check that the device generates a fresh phrase during setup. Our guide what is a hardware wallet explains how setup should look, and how to spot crypto scams covers the task-scam pattern that funded this wallet in the first place.