A cryptocurrency scammer who ran a task-based fraud scheme has become one of the largest known victims of a supply-chain attack on Ledger hardware wallets, losing more than 60 bitcoin valued at approximately $4.8 million. Blockchain analytics firm Chainalysis identified the transactions and linked the funds to the illegal operation.

How the Task Scam Worked

According to Chainalysis, the operator collected bitcoin through a task scam. Participants were paid small amounts to create fake product sales and post reviews of real items. After building apparent earnings, a negative balance appeared in their accounts. Victims were then instructed to deposit their own money—often in cryptocurrency—to clear the balance and unlock payments that never arrived.

Task scams frequently begin with modest online work offers, sometimes paying $5 to $20 initially, before escalating demands for deposits to release supposed earnings.

Funds Moved to Compromised Wallets

On September 22, the scammer consolidated the proceeds and transferred them into three separate Ledger addresses. On October 9, attackers emptied all three addresses, sending the full balance from each into a single wallet that has been associated with stolen funds. Chainalysis data showed each of the three addresses held roughly $1.64 million at the time of the drain.

The transfers followed a consolidation step before the bitcoin reached the Ledger addresses, after which the funds were rapidly removed.

Tampered Devices and the Wider Incident

The theft forms part of a larger security breach involving Ledger hardware wallets sold through Southeast Asian reseller CryptoBilis. Ledger’s security team determined that certain devices contained unauthorized implants. These components captured the 24-word recovery phrase displayed during initial setup and transmitted the data over a mobile network, allowing remote access to the wallets.

Ledger has stated that every confirmed loss to date involves devices obtained through CryptoBilis. The company has not disclosed how many users were affected or the total value taken, and its investigation continues. Independent on-chain analysis has pointed to tens of millions of dollars in related activity across hundreds of addresses, though Ledger has not verified those higher figures.

In response, Ledger directed resellers and distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to halt sales of its devices. The firm is also revising reseller procedures, including keeping inventory off open display and prohibiting the resale of returned units.

Chainalysis did not identify the specific source from which the scammer acquired the three Ledger devices.

Ongoing Investigation

Ledger disclosed the implant findings around the same period the three addresses were emptied. The company maintains that the tampering occurred after the devices left its manufacturing control and that its core chip, operating system and servers were not compromised. The probe into the full scope of the incident remains active.