Blockchain analytics firm Chainalysis has identified a task scam operator as one of the largest victims of recent Ledger hardware implant thefts, with losses exceeding 60 Bitcoin valued at approximately $4.8 million.
According to Chainalysis, the scam operator moved the illicit proceeds into three Ledger addresses on September 22. On October 9, thieves emptied all three addresses in single transfers to a consolidation wallet. Each Ledger address was drained of roughly $1.64 million.
How the Task Scam Operated
The scam worked by paying people to create fake sales and reviews of legitimate products. Participants were then shown a negative balance in their accounts and told they needed to deposit their own money to receive payment.
The U.S. Federal Trade Commission reported that task scams comprised nearly 40% of job fraud reports in 2024, with cryptocurrency as the preferred payment method. The agency documented $41 million in reported crypto losses to job scams during the first half of 2024.
The Ledger Implant Threat
On October 10, Ledger disclosed that an unauthorized hardware implant had been discovered inside one victim's signer device. The implant captures the device's 24-word recovery phrase during setup and transmits it via LTE through a provisioned eSIM.
Ledger has tied confirmed losses from the implant scheme to hardware signers sold through CryptoBilis, a Southeast Asian reseller. On-chain analyst Specter estimated total losses from the CryptoBilis-sourced devices at more than $86 million across Bitcoin, Ethereum, and TRON.
Ledger stated it has not confirmed the total number of affected users or total value lost. The company has advised anyone who purchased a signer from CryptoBilis to transfer assets to a new device with a new recovery phrase.
