Ledger Implant Theft Drains 60 BTC From a Task Scam Operator

A fraudster who had been parking the earnings of a so-called task scam ended up among the largest known losers in the tampered Ledger wallet affair. According to blockchain analytics firm Chainalysis, more than 60 BTC, worth roughly $4.8 million, sat in three Ledger addresses controlled by the scam's organiser until thieves swept them clean on October 9. The episode adds an ironic twist to a supply-chain attack that Ledger itself has described as among the most sophisticated the industry has seen, and whose full cost is still unconfirmed.

How the Stolen Bitcoin Changed Hands Twice

Chainalysis laid out the trail in a social media post on Thursday. The coins came from victims of a task scam. In this kind of scheme, recruits get small payments for staging bogus purchases and writing fake reviews of genuine products. Eventually their accounts show a "negative balance", and they are told to top up with their own money before they can withdraw anything. That deposit is where the real theft happens.

The on-chain picture Chainalysis shared shows this sequence:

• Proceeds from the scheme were first pooled in a consolidation wallet.
• On September 22, the operator split the funds across three addresses held on Ledger devices.
• On October 9, each of those addresses was emptied in a single transaction, losing roughly $1.64 million apiece.
• All three transfers landed in one destination wallet, which has since been flagged as holding stolen funds.

Chainalysis has not disclosed where the scam operator got the hardware wallets in question.

Background: The CryptoBilis Implant Attack

The wider story began last week, when Paris-based Ledger opened an investigation after users in Southeast Asia reported drained wallets. Their common link was CryptoBilis, a reseller based in Malaysia. Ledger's internal security research unit, Donjon, later found that devices sold through that channel carried a hidden implant. During initial setup, the component captured the 24-word recovery phrase shown on the screen and transmitted it over an LTE connection. That gave the attackers everything they needed to empty the wallet later.

Ledger has described the operation as the work of an organised criminal group that modified devices and returned them to the retail market. The company says every confirmed loss so far traces back to units sold by CryptoBilis, which has since stopped offering Ledger products. Ledger says it is cooperating with law enforcement to trace the money and take down the attackers' infrastructure. On Tuesday it also urged sellers and distribution partners across Hong Kong and six Southeast Asian nations to halt sales of its hardware.

How Large Are the Losses?

Ledger has not confirmed how many users were affected or how much was stolen in total, and its inquiry is still under way. Independent on-chain investigator Specter has tracked suspected thefts exceeding $86 million, a figure Ledger has not independently confirmed. If the Chainalysis attribution holds, the scam operator's $4.8 million would be a meaningful slice of whatever the final tally turns out to be.

The incident also caps a difficult year for hardware wallet security. According to Bitcoin Magazine, Coldcard users lost nearly $120 million worth of bitcoin in July after a firmware flaw produced weak seeds that attackers were able to guess. The two cases work differently: one was a software bug, the other physical tampering in the distribution chain. Both, however, undermine the basic promise of cold storage.

What This Means and What to Watch

One criminal robbing another is ironic, but it should not hide the broader lesson. A hardware wallet is only as trustworthy as the path it took to reach its owner. Buying through unofficial or third-party sellers adds a risk that no amount of on-chain caution can fix afterward. In general, security practitioners have long recommended buying devices directly from manufacturers or authorised partners and generating a fresh seed on a device whose packaging and integrity can be checked.

Several questions remain open. Ledger has yet to publish a verified loss figure or say how many tampered units reached customers. It is also unclear whether the original task-scam victims have any route to recovery now that their money has been stolen a second time. Observers will be watching for:

• Ledger's final incident report
• any law enforcement action against the group behind the implants
• whether the sales pause in Southeast Asia and Hong Kong is lifted or extended