Mentioned in This Article
1. A Ledger wallet hack that caught a scammer
Blockchain analytics firm Chainalysis reported on Thursday, October 15, that a scammer who ran a task-scam scheme was among the largest known victims of the Ledger wallet hack, losing more than 60 bitcoin (BTC), worth roughly $4.8 million. The funds sat in three Ledger addresses until thieves emptied them into a single wallet on October 9, the day Ledger disclosed the tampering problem.
The episode has drawn a measure of mockery online, since the person who lost the money had gathered it from people deceived by a fake-work scheme. Yet the case also carries a more serious lesson about how a compromised hardware wallet can strip value from anyone who stores funds in it, regardless of who they are or how the money was obtained.
Chainalysis, whose software is widely used by exchanges, law enforcement agencies and compliance teams to follow money across public blockchains, laid out the sequence of transactions in a post on the social platform X. The post described the scam, the dates on which funds moved and the way the three addresses were cleared out in a coordinated fashion.
2. How does a task scam work?
A task scam is a form of online employment fraud in which victims are recruited with the promise of easy paid work. In this case, participants were paid to simulate sales and write reviews for real products, activity that gives the impression of consumer demand and satisfaction. The assignments looked like ordinary gig work, which is part of what makes the scheme persuasive.
The trap springs later. After victims complete a series of assignments, a negative balance appears in their account on the scam platform. They are then told they must deposit their own money to clear that balance before their earnings can be released. Each deposit is presented as the final step, yet the pay never arrives, and the operators keep the funds that were sent in.
That deposit stage is the source of the bitcoin at the center of this story. According to Chainalysis, the roughly $4.8 million in BTC came from this task scam, meaning it represents money collected from people who believed they were working for a legitimate employer. The recruitment tactic relies on the same psychology as many other frauds: small early successes build trust, and a manufactured obligation pushes the victim to pay more.
Fraud of this kind is attractive to criminals because it can be run at scale, with many victims each contributing a modest amount, and because payments in cryptocurrency are quick to collect and difficult to reverse. Once the proceeds are in hand, the operators face the practical question of where to keep them, and in this instance the answer involved hardware wallets.
3. What happened to the funds between September 22 and October 9?
On September 22, the scammer shifted the proceeds into three separate Ledger addresses. Chainalysis traced the money as it first passed through a consolidation wallet, a staging address where funds from many incoming payments are gathered, before being split across the three Ledger-controlled destinations.
The balances stayed there for more than two weeks. Then, on October 9, the thieves moved quickly: a single transfer left each of the three addresses, and all three transfers landed in the same wallet. Chainalysis noted that this destination has been reported as holding stolen funds, which links the scammer's loss to the broader pattern of thefts associated with the tampered devices.
A chart included in the Chainalysis post indicates that each of the three addresses was drained of about $1.64 million. The individual figures are approximate and, taken together, come out slightly above the headline total of $4.8 million, so the overall number is best read as an estimate of more than 60 BTC rather than an exact accounting.
The fact that every address was emptied on the same day, and into one shared wallet, points to an operation in which the attacker already held the means to spend from all three. That detail matters because it is consistent with the way the tampering is described: the thief did not need to break into the funds afterward, because the secret needed to control them had already been captured.
4. What did Ledger find inside the compromised devices?
Ledger disclosed the incident on October 9. Its Donjon security team, the group that tests the company's hardware and software for weaknesses, examined affected units and found an implant inside wallets that had been sold through CryptoBilis, a reseller operating in Southeast Asia.
According to Ledger's findings, the implant reads the 24-word recovery phrase from the device screen while the owner is setting up the wallet, and then transmits it over an LTE mobile connection. A recovery phrase is the master credential for a hardware wallet. Anyone who holds those 24 words can recreate the wallet on another device and move every asset it controls, without needing the physical hardware or the owner's PIN.
This design explains why the losses could occur even though a hardware wallet is meant to keep private keys offline. The protective model assumes the device itself is genuine and untouched. When a unit is altered before it reaches the customer, the owner may follow every recommended setup step and still hand over the one piece of information that guards the funds.
Ledger says every confirmed loss so far involves a device sold by CryptoBilis. That statement narrows the problem to a particular distribution channel rather than to the company's products as manufactured, although it also shows how a weak link in resale and distribution can undermine the security of an otherwise well-regarded product.
5. Where did the scammer buy the wallets?
Chainalysis did not say where the scammer obtained the devices. That leaves an open question about whether the wallets were purchased from CryptoBilis, as in the confirmed cases Ledger has described, or reached the scammer by some other route. The firm's report establishes how the money moved, not how the hardware was acquired.
Ledger, for its part, ties all losses it has confirmed to devices sold by the reseller. The company has not publicly connected the scammer's three addresses to a specific purchase, and nothing in the available reporting from Chainalysis supplies that link. Readers should therefore treat the scammer's case as consistent with the wider pattern, not as a verified instance of a CryptoBilis sale.
The distinction is worth keeping in view because the scale of the incident is still being established, and details tend to shift as investigators compare on-chain records with the accounts of affected owners. Separating what has been confirmed from what has been inferred helps avoid attributing losses to the wrong cause.
6. How large are the total losses?
The scammer's loss of about $4.8 million is notable mainly because Chainalysis described it as one of the largest among the wallets drained, but it is a fraction of the wider estimate. An on-chain investigator who goes by Specter has traced more than $86 million in suspected thefts linked to the incident. Ledger has not verified that figure.
Ledger itself has not confirmed either the number of users affected or the total value lost. Its investigation is ongoing, so the totals could change as more addresses are identified and as owners come forward. For now, the company's public position rests on the mechanism of the implant and the common thread of the CryptoBilis sales channel.
The gap between a large trace figure from an outside analyst and the lack of an official total is typical of the early period after a security incident. Independent researchers can follow transfers on a public ledger quickly, while a company must verify which devices were altered, who owned them and whether each wallet drain was caused by the same flaw.
7. What has Ledger done in response?
On Tuesday, October 13, Ledger asked resellers and distributors in six Southeast Asian countries and Hong Kong to suspend sales of its devices. The request is a precaution aimed at stopping further sales through channels where tampered units might still be circulating, while the company works out the full extent of the problem.
For buyers, the practical takeaway concerns where a hardware wallet comes from. Security specialists have long advised purchasing directly from a manufacturer or an authorized seller, and treating any device that arrives opened, pre-initialized or accompanied by a pre-written recovery phrase as untrustworthy. The Ledger case shows what can go wrong when that guidance is ignored or when a reseller is itself the point of compromise.
Anyone who bought a device through a third-party seller in the affected region has reason to check with the manufacturer and consider moving funds to a freshly generated wallet from a device obtained through a verified channel. Moving assets cannot recover what has already been taken, but it can prevent additional theft if a recovery phrase has been exposed and the funds have not yet been moved.
8. What happens next?
Ledger has said its investigation is continuing, and the company has yet to publish a count of affected users or a final loss figure. Further disclosures from Ledger, along with additional tracing by Chainalysis and independent investigators, are likely to clarify how many wallets were altered and how much was taken.
For the scammer in this account, the outcome is a rare reversal. Funds taken from people through fake-work deposits were captured by a different set of thieves using a flaw the scammer almost certainly never suspected. For everyone else who relies on a hardware wallet, the more lasting point is that the security of cold storage depends on the integrity of the device and the supply chain behind it, as much as on the cryptography inside it.