A hacker operating a widespread “task scam” scheme has lost approximately 60 Bitcoins, valued at around $4.8 million, as a result of the recent Ledger hardware wallet hack. The stolen amount highlights both the scale and reach of the security breach affecting the crypto hardware wallet sector.
Scammer among major victims in hardware wallet exploit
Chainalysis, a blockchain analytics company, reported that the scam operator initially transferred illicitly acquired Bitcoin into three separate Ledger wallets on September 22. On October 9, these funds were consolidated and sent to a wallet previously linked to stolen assets.
Despite the significant loss to the scammer, there is currently no indication that the original victims of his scheme have recovered their funds.
Task scams often involve building trust with small payouts before pressuring individuals to deposit additional money under false pretenses such as a “negative balance.”
How task scams target individuals
The accused operator organized fake jobs and paid participants to carry out fabricated sales and reviews. After a period of building trust, victims were informed of an alleged negative balance and were persuaded to deposit their own money to receive promised payouts.
In 2024, the US Federal Trade Commission (FTC) described similar fraudulent schemes where small online tasks create the illusion of legitimate employment. The FTC estimated that about 20,000 reports concerning task scams had been filed in the first half of 2024, with overall job scam losses surpassing $220 million.
Tampered Ledger devices and method of attack
According to a statement from Ledger, the perpetrators purchased genuine hardware wallet devices, implanted malicious components within them, and then reintroduced the tampered products into Southeast Asian distributor channels. These modifications enabled the collection of 24-word recovery phrases during device setup, giving attackers remote access to affected wallets.
Ledger maintains that its systems remain secure and has instructed authorized sellers to cease displaying devices openly, supplying them only at the time of purchase.
Mini dictionary: Ledger is a French company specializing in cryptocurrency hardware wallets, widely used for the self-custody of digital assets.
Damage assessment and expanding industry response
While Ledger has not provided an official loss total, Bitquery, a blockchain analytics firm, estimated that around $102 million was stolen from 324 wallets spread across six blockchains: TRON, Bitcoin, Ethereum, Solana, BNB Chain, and Polygon. This figure increased from a prior estimate of $86 million.
Bitquery identified CryptoBilis, a hardware wallet reseller operating in Indonesia, Malaysia, and the Philippines, as an origin point for the affected devices. Stolen funds showed coordinated movement, including $10 million in USDT that Tether subsequently froze. Further portions of the assets were traced through protocols such as Tornado Cash and THORChain.
| Blockchain | Estimated Stolen Funds | Notable Actions |
|---|---|---|
| Bitcoin | ~$60 million | Linked to task scammer loss |
| Ethereum | n/a | Funds moved via mixers |
| TRON | n/a | Included in total loss count |
| Solana | n/a | Part of affected wallets |
| BNB Chain | n/a | Part of affected wallets |
| Polygon | n/a | Part of affected wallets |
Mini dictionary: Tornado Cash and THORChain are decentralized protocols that enable the mixing or swapping of cryptocurrencies, often used to obfuscate the origin and movement of digital assets.
Growing industry concerns and countermeasures
The Ledger incident has intensified concerns regarding cryptocurrency security and the vulnerability of hardware wallet supply chains. TRM Labs reported 207 crypto attacks during the first half of 2026, with $972 million in losses. Notably, while infrastructure and operational breaches made up 15% of attacks, they accounted for 76% of overall losses.
Although the recent Ledger theft has captured industry attention, researchers have not identified a significant impact on overall cryptocurrency market prices.
Chainalysis observed that despite several high-profile thefts, on-chain economic activity decreased only 1.6% during a period when the broader crypto market capitalization dropped by about half, though these statistics predate the Ledger hack.
In response to ongoing threats, hardware wallet manufacturers and resellers are adjusting their security policies. Trezor, a leading hardware wallet provider, announced the termination of some reseller authorizations effective January 1, 2027. OneKey, another wallet producer, ended its relationship with CryptoBilis. Industry sources indicate that these measures aim to address supply chain weaknesses but restoring full trust in self-custody solutions remains a challenge.
