A cryptocurrency scam operator became one of the largest individual victims identified in the recent Ledger hardware-wallet supply-chain attack, losing more than 60 Bitcoin worth approximately $4.8 million. Chainalysis traced the BTC to proceeds from a task scam before all three wallets holding the funds were emptied during the coordinated October 9 theft.
The loss forms part of a much broader hardware-tampering campaign. According to a Financial Times investigation, attackers stole approximately $90 million after compromised Ledger devices circulated through reseller channels. The $4.8 million attributed to the task-scam operator therefore represents one identified loss inside a substantially larger supply-chain attack rather than the incident-wide damage figure.
Ledger’s official technical investigation found that genuine devices had been opened after leaving the company’s control, fitted with hidden hardware and returned to distribution. The implant could capture a user’s recovery phrase during wallet setup and transmit it remotely without compromising Ledger’s Secure Element, operating system or servers.
Stolen Scam Proceeds Were Stolen Again
Chainalysis said the operator had accumulated the Bitcoin through a task scam in which victims were encouraged to perform activities such as creating artificial sales or reviews before being shown supposed negative balances and asked to deposit their own money. The U.S. Federal Trade Commission describes the same basic model: users see fictitious earnings before being told they must contribute real funds, frequently in cryptocurrency, to unlock them. The BTC later stolen from the Ledger wallets had therefore already been linked by investigators to an earlier fraud scheme.
On September 22, the operator transferred more than 60 BTC into three Ledger addresses. On October 9, all three addresses were drained, with the funds ultimately moving to the same destination associated with the broader hardware-wallet attack. The transfer did not return the Bitcoin to the original scam victims; control simply passed from one suspected illicit actor to another.
Ledger’s Donjon security team found that the malicious hardware operated outside the wallet’s normal cryptographic trust boundary. The implant monitored information displayed during initialization, reconstructed the 24-word recovery phrase and transmitted it using cellular connectivity. Once the attackers obtained the seed phrase, they could recreate the wallet elsewhere and move its assets without compromising the Secure Element itself.
Physical Distribution Became the Security Boundary
The attack initially centered on devices distributed through CryptoBilis, an authorized reseller serving parts of Southeast Asia. Ledger subsequently asked resellers and distributors across Southeast Asia and Hong Kong to suspend sales while it investigated where tampering entered the distribution chain. The response followed an earlier regional suspension of Ledger wallet sales. Ledger says the evidence points to manipulation after devices left its direct control rather than a breach of its internal servers or firmware.
The incident differs from security failures in which wallet secrets are exposed entirely through software. A Coldcard exploit involving weakened entropy reached private keys through wallet-generation logic, while a Trezor-related phishing campaign exploited a third-party communications provider. In the Ledger case, the critical failure occurred in the physical supply chain before the recovery phrase could remain protected inside the intended security model.
Ledger has since suspended affected regional sales channels, examined inventory and coordinated with law enforcement and blockchain investigators. The task-scam loss adds an unusual layer to the case, but the underlying technical lesson is broader: hardware-wallet security still depends on device provenance when attackers can physically modify genuine units before they reach users.
