A fraudster who ran a “task” scam lost more than 60 Bitcoin—valued at nearly $4.8 million—after the coins were siphoned from compromised Ledger hardware wallets.

Ledger hardware breach

Ledger, the French hardware-wallet manufacturer, opened an investigation after customers in Southeast Asia reported missing funds following purchases from Malaysia-based reseller CryptoBilis. The company said a sophisticated operation had installed malicious implants into the devices before they were sold. These implants could capture seed phrases, allowing attackers to empty the wallets. On 22 September, the perpetrator moved the proceeds into three separate Ledger addresses; on 9 October, all three were drained in a single transaction to an address identified as stolen funds. Ledger is cooperating with law-enforcement agencies to trace the flow of the cryptocurrency and dismantle the criminal infrastructure.

The scammer’s loss

Chainalysis linked the stolen Bitcoin to an address used in a “task” scam where participants were paid to post fake sales and product reviews. Victims were instructed to add their own money to receive payment, after which the scammers absconded with the funds. The address associated with that operation received the 60 BTC that were later stolen in the Ledger breach, effectively turning the fraudster into a victim of the same type of theft.

Wider hardware-wallet attacks

The Ledger incident follows a series of high-profile hardware-wallet compromises this year. In July, users of Coldcard devices suffered losses estimated at $120 million after a firmware flaw generated weak seed phrases that could be guessed by attackers. Both incidents highlight the growing targeting of hardware-wallet supply chains and the potential for large-scale theft when device integrity is compromised.

Why it matters

The episode underscores the vulnerability of hardware wallets when supply-chain security is breached, even for products marketed as the most secure crypto storage solution. It also illustrates how illicit actors can become victims of the same tactics they employ, adding another layer of complexity to the ecosystem’s risk profile. Ongoing collaboration between manufacturers, resellers, and law-enforcement will be crucial to restore confidence in hardware-based custody solutions.