Crypto Scammer’s Double Loss: Millions Stolen and Drained in Ledger Hack

Key Lessons for Bitcoin Holders from the Recent Ledger Security Breach

Crypto Scammer Falls Victim to Double Theft in Ledger Hack

In a bizarre turn of events, a crypto scammer has become one of the largest victims of a recent Ledger hack, highlighting vulnerabilities in the cryptocurrency supply chain. According to blockchain analytics firm Chainalysis, the scammer, who operated a “task scam,” transferred millions in stolen funds into hardware wallets for safekeeping, only to watch helplessly as another thief drained the wallets just days later.

On September 22, 2026, the scammer moved over 60 Bitcoin—worth approximately $4.8 million—into three Ledger addresses. However, on October 9, all three wallets were emptied in a single transfer to a different wallet, leaving the scammer with nothing. This incident not only underscores the risks faced by victims of scams but also raises questions about the security of hardware wallets.

The Mechanics of a Task Scam

Task scams lure unsuspecting individuals with promises of easy online work, such as liking videos or rating products. The Federal Trade Commission (FTC) categorizes these as gamified job scams, which typically unfold in four stages:

1. The Fake Job Offer: Victims receive enticing messages offering simple remote work.
2. Initial Small Payments: Some participants receive small payments to build trust.
3. Negative Balance Trick: Victims are shown a “negative balance,” claiming they must deposit money to withdraw their earnings.
4. Demand for More Deposits: Scammers continue to request additional payments, which flow directly to the operator.

Investigators traced the funds from these scams to the scammer’s Ledger wallets, complicating recovery efforts for the victims.

The Ledger Hack: A Supply Chain Vulnerability

On October 13, Ledger revealed that devices sold through a Southeast Asian reseller, CryptoBilis, had been compromised with hidden hardware implants. These implants could read information displayed on the wallet’s screen, capturing users’ 24-word recovery phrases and transmitting them over an LTE connection. This breach coincided with the draining of the scammer’s wallets, raising alarms about the security of Ledger devices.

Despite the Secure Element chip, which protects users’ keys, remaining intact, Ledger warned that compromised devices could still pass authenticity checks. The company has paused sales and shipments of Ledger devices while investigating the matter. Estimates of losses from these compromised devices range from $86 million to $90 million, though Ledger has not confirmed these figures.

Bitcoin Market Reaction

Despite the chaos, Bitcoin’s price has remained relatively stable, trading at $81,544 with only minor fluctuations. This resilience can be attributed to the fact that the theft originated from a compromised reseller’s hardware, rather than the Bitcoin network itself. Holders who generated their keys using secure hardware face no new risks from this incident.

Lessons for Bitcoin Holders

The dual theft serves as a cautionary tale for Bitcoin holders. From the task scam, it’s crucial to remember that legitimate employers will never require payment to receive wages. Any app requesting a “negative balance” top-up is likely a scam. From the Ledger hack, users should verify the source of their hardware wallets. Ledger has advised anyone who set up a CryptoBilis device to transfer their assets to a new wallet with a new recovery phrase immediately.

As investigations continue, Ledger is also reviewing reports of implants in other devices, raising the possibility that this issue could extend beyond CryptoBilis to the broader retail market. This situation underscores the need for vigilance among cryptocurrency users regarding the origins of their hardware wallets.

For further inquiries or corrections, please contact [email protected].