Scammer Loses $4.8 Million in Bitcoin After Ledger Wallets Were Compromised

A fraudster who had amassed more than 60 BTC from a task-scam operation lost the entire haul after the Bitcoin was transferred to compromised Ledger hardware wallets.

Details

Blockchain analytics firm Chainalysis traced the flow of the stolen Bitcoin, estimating its value at roughly $4.8 million. The illicit proceeds were first moved into three separate Ledger addresses on 22 September. By 9 October, the three wallets had each been emptied, with the funds converging into a single destination wallet that is now associated with the theft.

The stolen coins originated from a scheme in which participants were paid to fabricate sales and product reviews. Victims later discovered a “negative balance” on their accounts and were instructed to add personal funds to resolve the issue, a classic bait-and-switch tactic.

Ledger response

Ledger’s internal security team, Donjon, disclosed that the compromised devices were sold through a Southeast Asian reseller named CryptoBilis. An implanted component allegedly read the 24-word recovery phrase displayed during device setup and transmitted it over cellular networks. All confirmed losses involve hardware purchased from that reseller, though the exact purchase channel for the scammer remains unclear.

In reaction, Ledger asked distributors and resellers across six Southeast Asian nations and Hong Kong to suspend sales of its products while the investigation proceeds. The company has not released a total count of affected users or an aggregate value of the losses, stating that the inquiry is ongoing.

On-chain researcher Specter has linked more than $86 million in suspected thefts to similar tampered devices, a figure that Ledger has not independently verified.

Why it matters

The incident underscores the risks inherent in hardware wallet supply chains, especially when devices are sourced from third-party sellers. Even sophisticated users can fall victim if malicious firmware or hardware modifications are introduced before the device reaches the consumer. For the broader crypto ecosystem, the case highlights the importance of rigorous vendor vetting and the need for users to obtain hardware wallets directly from manufacturers or trusted retailers. Ongoing investigations will likely shape future security standards and resale policies for crypto-related hardware.