Recent findings from blockchain analysis firm Chainalysis indicate that a supply chain attack targeting Ledger hardware wallets resulted in task scammers losing 60 bitcoin, valued at approximately $4.9 million, to secondary thieves.
According to Chainalysis, proceeds from a task scam were moved into three separate Ledger addresses on September 22. On October 9, thieves drained all three addresses in separate transfers directed into the same wallet known to hold stolen funds.
The sequence of events involves multiple layers of illicit activity. Initially, victims fell for a task scam that required them to write fake sales reviews and deposit personal funds into negative balances. Those funds were funneled to the scammers, who subsequently lost the accumulated assets to the hardware wallet tamperers. MetaMask security expert Taylor Monahan commented on the development regarding the targeted scammers.
Ledger stated that a highly organized criminal group carried out the attacks against device users, noting that the perpetrators may have spent millions on the operation. Cryptobilis, the company that sold the affected Ledger wallets, had been acquired earlier in the year by an undisclosed party.
Ledger reported that it is working with law enforcement and the security community to track the funds and dismantle the infrastructure used by the attackers. On October 15, the company stated that it inspected a large number of samples from its own stock and found no compromised units. Despite the crisis and unverified reports of $93 million in crypto asset losses among users, Ledger unveiled its upcoming $849 Android device, Atom, on October 15.
