In brief
- Blockchain analytics firm Chainalysis said one of the biggest victims of the Ledger wallet drain was a scammer who lost more than 60 BTC, about $4.8 million.
- The scammer moved the proceeds into three Ledger addresses on September 22, and thieves emptied all three into a single wallet on October 9.
- Ledger has tied all confirmed losses to devices sold by reseller CryptoBilis, though Chainalysis did not say where the scammer bought the devices.
Recent revelations of thefts from tampered Ledger hardware wallets sparked some schadenfreude, after it was revealed that one of the biggest victims was a scammer who lost more than 60 BTC.
Blockchain analytics firm Chainalysis revealed the transactions behind the theft, which saw some $4.8 million worth of Bitcoin stolen, in a tweet on Thursday.
The Bitcoin came from a task scam, according to Chainalysis. People were paid to fake sales and reviews of real items, until a "negative balance" appeared in their accounts and they were told to add their own money in order to get paid.
One of the biggest victims of the Ledger theft was a scammer themselves. They lost more than 60BTC, about $4.8M. The funds were from a task scam.
In this task scam, people were paid to fake sales and reviews of real items. Then a "negative balance" appeared, and they were told… https://t.co/IJX4tx9ib3 pic.twitter.com/pGXNJkZJUi
— Chainalysis (@chainalysis) October 15, 2026
On September 22, the person behind the scam moved the proceeds into three separate Ledger addresses. On October 9, thieves emptied all three, with one transfer from each into the same wallet, which has been reported as holding stolen funds.
A chart shared by Chainalysis shows the scam proceeds passing through a consolidation wallet before reaching the three Ledger addresses, each of which was drained of about $1.64 million.
Ledger disclosed the incident on October 9.
Ledger's tampered devices
Ledger's Donjon security team disclosed that it had found an implant in wallets sold through Southeast Asian reseller CryptoBilis, which reads the 24-word recovery phrase from the screen during setup and sends it out over LTE. The company has said that all confirmed losses involve devices sold through CryptoBilis.
Chainalysis did not say where the scammer bought the devices.
Onchain investigator Specter has traced more than $86 million in suspected thefts, a figure Ledger says it has not verified. On Tuesday, Ledger asked resellers and distributors in six Southeast Asian countries and Hong Kong to suspend sales of its devices.
Ledger has not confirmed the total number of affected users or the value lost, and its investigation is ongoing.
Join 72,000+ readers
Create an account to save your articles.
Add Decrypt as your preferred source to see more of our stories on Google.
