One of the Biggest Victims of the Ledger Hack Was a Crypto Scammer.
A crypto scammer moved millions in stolen funds into hardware wallets for safekeeping, only to watch a second thief drain every last coin days later. The chain of events reveals a supply chain threat that could put far more than…
This post may contain links from our sponsors and affiliates, and Flywheel Publishing may receive compensation for actions taken through them.
In an unexpected twist, a crypto scammer ranks among the largest victims of the Ledger hack, according to blockchain analytics firm Chainalysis. On September 22, 2026, the operator of a “task scam” transferred the scam’s earnings into three Ledger addresses. Then, on October 9, criminals drained all three wallets, each in a single transfer to the same wallet, stealing over 60 Bitcoin (CRYPTO:BTC) (worth about $4.8 million).
This theft created a double loss: the scammer not only deceived their victims, but also lost the money to another party. Each of these scams offers valuable lessons, so what should Bitcoin holders take away from the Ledger hack about keeping their coins safe?
How a Task Scam Filled the Scammer’s Ledger Wallets
A task scam is a fake online job that offers simple chores in an app but ultimately requires users to pay to collect their earnings. The Federal Trade Commission (FTC) classifies these as gamified job scams. They usually begin with an unexpected message offering “work,” like “optimizing” online content or “boosting” products. Chainalysis’s investigation identified a scam model that operated in four basic steps:
- The Fake Job Offer. A stranger offers easy remote work, such as liking videos or rating product images in an app.
- Initial Small Payments. Some participants receive small payments, typically between $5 and $20, to build trust with the scammer, according to the FTC.
- Negative Balance Trick. The app then shows a “negative balance,” claiming users must add their own money to withdraw their earnings.
- Demand for More Deposits. As tasks continue, scammers request additional deposits, with each payment flowing directly to the operator.
Investigators traced the deposits collected from victims to three Ledger addresses on September 22. Therefore, the hackers stole more than 60 BTC from money scammed from unsuspecting users, making recovery for those victims even more challenging.
How Tampered Ledger Wallets Helped Thieves Access Recovery Phrases
On October 13, Ledger, the Paris-based hardware wallet maker, revealed that devices sold through a Southeast Asian reseller named CryptoBilis had hidden hardware implants. A hardware wallet safely stores cryptographic keys offline, but these implants were able to read information displayed on the wallet’s screen.
During setup, the implants captured each user’s 24-word recovery phrase and transmitted it over an LTE cellular connection using an embedded eSIM. This recovery phrase acts as a master backup for a wallet, meaning anyone with access to it can control all the coins in that wallet. Ledger reported that the theft occurred on October 9, coinciding with the draining of the scammer’s wallets.
Ledger further warned that, despite the implants compromising device security, the Secure Element chip, which protects users’ keys, remained intact. This may allow compromised devices to pass Ledger’s authenticity checks. The company noted that all confirmed thefts involved CryptoBilis devices, primarily in Southeast Asia. In response, CryptoBilis stated it had “paused all sales and shipments of Ledger devices while Ledger investigates.”
While Ledger has not provided an official figure for total losses, blockchain investigator Specter estimates losses from these compromised devices exceed $86 million, and on-chain analytics firm Santiment suggests around $90 million. However, Ledger has not confirmed these figures and urges users to be cautious, as they remain speculative estimates.
Bitcoin’s Price Shrugged Off the Ledger Hack
Bitcoin is trading at $81,544, showing little change over the past 24 hours and only a slight 1.7% drop over the past week. These minor fluctuations are typical of the market and do not seem to be a direct response to the hack.
This reaction makes sense because the theft originated from one compromised reseller’s hardware, and the Bitcoin network was not harmed. Holders who generated their keys using secure hardware face no new risks related to this incident.
Conversely, Ledger faces a significant reputational challenge. Its brand relies on ensuring the safety of its devices, and the revelation of a compromised supply chain undermines that trust.
What Should Bitcoin Holders Learn From the Ledger Hack?
From the task scam, Bitcoin holders should remember that a legitimate employer will never require employees to pay to receive their wages. Any app requesting a “negative balance” top-up is likely a scam. From the Ledger theft, the lesson is to verify your hardware wallet’s source. Ledger advised buyers who already set up a CryptoBilis device to “transfer your assets promptly to a new signer with a new recovery phrase,” and those who haven’t to contact Ledger Support first.
The threat may extend further. Ledger is “also reviewing reports of implants in other signers and locations.” If further investigations confirm implants in devices sold beyond CryptoBilis, the issue could spread from this one reseller to the broader retail market, meaning every Ledger owner might need to reassess the origins of their devices.
Contact [email protected] for any questions or corrections.
Sam Daodu is a crypto analyst who's spent nearly a decade making blockchain understandable—no easy task when most whitepapers read like fever dreams. He writes for 24/7 Wall St., covering Bitcoin, altcoins, and crypto market analysis for investors. Before crypto, he was a tech writer (back when explaining "the cloud" was peak innovation). Since 2018, he's written for CoinTelegraph, Yahoo Finance, The Block, Cryptonews, Zypto, Rain, and more—basically anywhere people want crypto news without the headache. Sam runs MacLabs Marketing, a content agency for crypto brands tired of sounding like AI wrote their website. He also publishes free crypto education on his site for Web3 enthusiasts who think "gas fees" is a typo. When he's not writing or staring at charts, Sam's either: - Watching anime (currently convinced One Piece has better tokenomics than most altcoins) - At the gym sculpting himself into a Greek god - Listening to the music your mum warned you only bad boys listen to Connect: LinkedIn | Email | MacLabs Marketing
