Scammer Loses Bitcoin to Compromised Ledger Wallets
-
Written by
Simonas Brazionis - Updated 2026-10-18 02:34:32
A scammer reportedly lost over 60 Bitcoin, valued at approximately $4.8 million, due to compromised Ledger wallets. This incident highlights vulnerabilities even for experienced operators in the crypto space.
Blockchain analytics firm Chainalysis identified the transactions, noting the funds originated from a “task scam.” In this scheme, individuals were paid to simulate sales and reviews, then instructed to deposit their own money to access payouts, a common tactic used by fraudsters.
Table of content
The Scam and Subsequent Theft
The scammer transferred the Bitcoin into three separate Ledger wallet addresses on September 22. These wallets were subsequently emptied by thieves by October 9, with all funds consolidated into a single wallet. Each of the three Ledger wallets reportedly held about $1.64 million before being drained, indicating a significant loss.
This sequence of events suggests that the scammer, despite their own illicit activities, fell victim to a more sophisticated attack, losing a substantial amount of cryptocurrency. The rapid draining of the wallets points to a pre-planned and efficient operation by the thieves.
Ledger's Investigation and Response
Ledger has attributed all confirmed losses to devices sold by the reseller CryptoBilis. Chainalysis, however, did not specify the purchase location of the Ledger wallets used by the scammer, leaving some details of the compromise unclear. This distinction is crucial for understanding the full extent of the supply chain vulnerability.
Ledger's internal security team, Donjon, identified an implant in wallets from CryptoBilis. This implant is designed to extract the 24-word recovery phrase during the setup process and transmit it via LTE. The company has since requested resellers and distributors in six Southeast Asian countries and Hong Kong to halt sales of its devices, taking steps to mitigate further risks.
Scope of the Compromise
An independent on-chain investigator, Specter, has tracked over $86 million in suspected thefts related to these incidents. However, Ledger has not yet verified this total amount, indicating ongoing investigations and a cautious approach to confirming the full impact.
Ledger has also not yet confirmed the total number of affected users or the full value of assets lost. The company's investigation remains active, suggesting that more information regarding the scale of the compromise may emerge as they continue their analysis.
