Scammer Loses 60 $BTC to Tampered Ledger — A $4.8M Lesson in Irony 📉

A scammer who built a fraudulent review operation out of fake sales and fabricated product ratings lost more than 60 $BTC, valued at roughly $4.8 million, after the proceeds were drained from tampered Ledger hardware wallets, according to research published by Chainalysis on October 15. Blockchain analytics firm Chainalysis traced the funds and identified the theft as one of several linked to compromised Ledger devices.

The original scheme was a "task scam" in which participants were paid to post fake sales and reviews of legitimate items. Targets were eventually shown a "negative balance" in their accounts and instructed to add their own funds to recover the supposed shortfall. On September 22, the operator behind the scam moved the illicit proceeds into three separate Ledger addresses. On October 9, thieves emptied all three in coordinated transfers of approximately $1.64 million each into an address flagged as holding stolen funds, per a chart shared by Chainalysis.

The compromise was disclosed by Ledger on October 9, when its Donjon security team reported finding an unauthorized hardware implant inside devices sold through Southeast Asian reseller CryptoBilis. The implant reads the 24-word recovery phrase from the device screen during setup and transmits it over LTE. Ledger confirmed the implant on Saturday in one affected user's device and said all confirmed losses involve units sold through CryptoBilis. The Paris-based hardware wallet maker did not specify where the affected scammer acquired the device, and Chainalysis did not identify the reseller.

On Tuesday, Ledger asked resellers and distributors in six Southeast Asian countries and Hong Kong to suspend sales of its devices while the investigation continues. Onchain investigator Specter has traced more than $86 million in suspected thefts linked to the incident, a figure Ledger said it has not verified. Ledger has not confirmed the total number of affected users or the aggregate value lost, and the inquiry remains ongoing.