In this article5 sections
A scammer who lost more than 60 BTC — about $4.8 million — in last week’s Ledger wallet drain was himself running a con, according to blockchain analytics firm Chainalysis, as reported by Bitcoinmagazine.
In a post on Thursday, Chainalysis tied the address to a task scam in which people were paid to fake sales and reviews of real items before a “negative balance” appeared and they were told to add their own money to get paid. Bitcoinmagazine described the outcome as poetic justice. Decrypt also reported the loss, noting that the revelation of thefts from tampered hardware wallets sparked some schadenfreude once the victim’s own scam was confirmed.
Also readTrezor Ends Reseller Authorizations on Jan. 1, 2027 After Ledger Scare
Chainalysis’s October 15 post stated that the victim lost more than 60 BTC, and that the funds originated in the task scam.
Key facts
- Chainalysis said the scammer moved the proceeds into three separate Ledger addresses on September 22.
- On October 9, thieves emptied all three addresses, moving one transfer each into the same wallet, which has been reported as holding stolen funds.
- Decrypt reported that each of the three Ledger addresses was drained of about $1.64 million, citing a Chainalysis chart showing the proceeds passing through a consolidation wallet first.
- Ledger disclosed the incident on October 9 and has tied all confirmed losses to devices sold by Malaysia-based reseller CryptoBilis.
- Onchain investigator Specter has traced more than $86 million in suspected thefts, a figure Ledger says it has not verified.
How the addresses were drained
The scam proceeds did not stay with the scammer for long. According to Chainalysis, the consolidation wallet fed three Ledger addresses, and all three were cleared on the same day in October. Decrypt reported that the three transfers went into a single wallet, one from each address, and that the destination wallet has been flagged as holding stolen funds.
Also readLedger Probes $92.9M Drain Tied to CryptoBilis Reseller
Chainalysis did not say where the scammer bought the Ledger devices, a detail Decrypt highlighted. Ledger’s Donjon security team, per Decrypt, found an implant in wallets sold through CryptoBilis that reads the 24-word recovery phrase from the device screen during setup and transmits it over LTE.
Ledger has called the operation a massive organized crime effort in which implants were installed in devices that were then returned to the market, and described it as one of the most sophisticated attacks the digital asset industry has seen. The company has not revealed how much money was lost overall, while Specter’s $86 million estimate remains unverified by Ledger.
On Tuesday, Decrypt reported, Ledger asked resellers and distributors in six Southeast Asian countries and Hong Kong to suspend sales of its devices. CryptoBilis has stopped selling Ledger products, Bitcoinmagazine reported. Ledger said it is working with law enforcement to follow the funds and dismantle the attackers’ infrastructure, and that it has confirmed no other vendors were targeted.
Hardware wallet attacks in 2026
The Ledger drain is not the year’s only hardware-wallet breach. Bitcoinmagazine noted that criminals hit Coldcard products in July, stealing close to $120 million in bitcoin after a firmware bug led to faulty seed generation that let attackers guess investors’ seed phrases.
The two incidents differ in method — Ledger’s involved tampered devices sold through a reseller, while Coldcard’s stemmed from a firmware flaw — but both put the security of self-custody hardware in front of a market that had treated it as a settled question. Ledger has not confirmed the total number of affected users or the value lost, and its investigation is ongoing.
Why it matters
Buyers who trust a sealed device and a printed recovery phrase now have two documented 2026 cases where that trust failed, which pushes the burden of proof onto resellers and manufacturers. For Chainalysis, the case is also a demonstration of how onchain tracing cuts both ways: the same tools that follow stolen funds also exposed the victim’s own scam.
Ledger’s instruction to pause sales across a region is a distribution-level response, a reminder that hardware wallet risk can enter through the supply chain rather than the firmware or the user.
What to watch
Two numbers remain open: Ledger’s own tally of lost funds and the number of affected users, neither of which the company has confirmed. Whether Specter’s $86 million figure is verified will shape how much of the damage is ultimately attributed to the CryptoBilis channel.
Sources: Bitcoin Magazine, Decrypt
