A prominent scammer was among the largest victims of the recent Ledger hardware wallet drain, losing more than 60 Bitcoin worth approximately $4.8 million, according to blockchain analytics firm Chainalysis.
In a social media post on Thursday, Chainalysis detailed the transaction history behind the theft. The stolen Bitcoin originated from a task scam operation, wherein participants were initially paid to fake sales and reviews for real products. Eventually, a fabricated "negative balance" would appear on their accounts, and victims were instructed to deposit their own funds in order to receive payment.
According to the analytics firm, the scammer transferred the illicit proceeds into three separate Ledger addresses on September 22. On October 9, thieves drained all three addresses, routing transfers into a single wallet known for holding stolen funds. A chart provided by Chainalysis illustrates the proceeds moving through a consolidation wallet before landing in the three Ledger addresses, with each being emptied of about $1.64 million.
Ledger officially disclosed the security incident on October 9. The company's Donjon security team identified a hardware implant in devices distributed through CryptoBilis, a reseller based in Southeast Asia. The implant captures the user's 24-word recovery phrase from the device screen during setup and transmits it via LTE. Ledger stated that all confirmed losses are tied to devices sold through CryptoBilis, though Chainalysis did not specify where the scammer purchased the affected hardware.
Onchain investigator Specter has tracked more than $86 million in suspected thefts related to the compromised devices, though Ledger has noted it has not verified that figure. Ledger advised resellers and distributors across six Southeast Asian countries and Hong Kong to suspend hardware sales on Tuesday. The company's investigation remains ongoing, and Ledger has not yet confirmed the total number of impacted users or the aggregate financial losses.
