Chainalysis finds scammer lost $4.8 million in Bitcoin in Ledger theft

A known crypto scammer has lost $4.8 million in bitcoin after falling victim to last week’s Ledger hardware wallet theft, according to a report from blockchain analytics firm Chainalysis.

Scammer loses stolen bitcoin in Ledger breach

Chainalysis stated that the individual, who previously orchestrated a “task scam” targeting unsuspecting victims, moved approximately 60 stolen bitcoins into three Ledger wallet addresses. The scam involved convincing people to fake sales and post fraudulent reviews, with the promise of payment. Victims were required to deposit their own money first, which the scammer then stole.

Chainalysis traced the scammer’s trail and discovered that the funds were sent to the Ledger addresses just weeks before the breach occurred. On October 9, thieves managed to drain all three addresses in single transfers, directing the bitcoin to a wallet flagged as containing stolen funds.

Chainalysis observed that one of the largest victims in the Ledger theft turned out to be a scammer who lost more than 60 BTC, equivalent to $4.8 million, from funds acquired through a task scam.

The firm described how the orchestrator of the task scam became a victim of a more sophisticated scheme. The stolen bitcoin was taken as part of a broader attack on Ledger devices, marking a rare instance where illicit gains disappeared through a new round of criminal activity.

Ledger attack targets resellers and users

Ledger, a leading Paris-based provider of hardware wallets for cryptocurrencies, confirmed last week that it had begun investigating reports of theft after customers in Southeast Asia reported funds missing. Those affected had purchased devices from a reseller, CryptoBilis, based in Malaysia.

According to Ledger, criminals installed custom implants into hardware wallet devices, allowing them to capture users’ seed phrases—the sensitive backup needed for wallet recovery. Once the information was transmitted, attackers were able to empty affected wallets.

Ledger called the incident one of the most sophisticated attacks seen in the crypto industry to date. While the exact losses are still unknown, blockchain investigation firm Specter reported that the criminals drained $86 million during the breach.

Mini dictionary: Ledger is a French company specializing in hardware wallets designed to securely store cryptocurrencies offline. These devices are widely used in the crypto sector as a defense against online attacks, but become vulnerable if tampered with before sale.

Ledger said it is cooperating with law enforcement agencies to help track and recover stolen funds, and is working to dismantle the criminal group’s operations. The company also stated that other vendors have not been affected by the implant scam.

CryptoBilis, the implicated Malaysian reseller, has stopped selling Ledger wallets following the attack.

Ongoing risks for hardware wallet users

This is not the first time hardware wallet sellers have faced such threats. In July, hackers targeted users of the popular Coldcard device by exploiting a firmware vulnerability. Cybercriminals stole nearly $120 million in bitcoin by identifying predictable seed phrases generated by compromised Coldcard firmware.

According to Chainalysis, both episodes highlight the persistent risks targeting hardware wallet providers and their customers as criminal schemes evolve.