Call it poetic justice: one of the biggest victims of a major hardware wallet security breach last week happened to be a scammer themself, according to blockchain analysts, resulting in a loss of nearly $5 million in bitcoin.
In a post shared on Thursday, blockchain analytics firm Chainalysis revealed that a malicious actor lost 60 bitcoins—valued at approximately $4.8 million—which they had previously stolen from everyday victims via a calculated "task scam."
According to Chainalysis, the address associated with these funds was directly linked to a deceptive online con where unsuspecting individuals were lured in with the promise of payment for faking sales and reviews of real commercial items. Participants in the scheme were initially led to believe they were earning money, but were eventually instructed to deposit their own funds in order to unlock their accrued payouts, at which point the scammers abruptly cut off access and stole their money.
However, the criminal mastermind behind this elaborate task scam ultimately fell victim to an even larger and more sophisticated trap. After accumulating the ill-gotten gains, the operator moved the stolen cryptocurrency to specific Ledger hardware wallet addresses. Unbeknownst to them, these exact addresses were subsequently targeted and compromised by an entirely separate ring of bad actors just last week.
Detailing the timeline of the funds, Chainalysis noted that on September 22, the person behind the task scam transferred the proceeds into three separate Ledger addresses. Weeks later, on October 9, thieves completely emptied all three addresses in a coordinated series of single transfers routed directly into a single wallet, which has since been publicly flagged and reported as containing stolen funds.
The broader security incident traces back to Paris-based hardware wallet manufacturer Ledger, which announced last week that it had launched an immediate internal investigation after customers in South East Asia reported mysterious losses of funds. These victims had purchased their hardware devices from an authorized regional reseller based in Malaysia known as CryptoBilis.
Ledger subsequently revealed that the security breach was part of a massive, highly organized criminal operation. Perpetrators had managed to physically tamper with the supply chain, installing malicious hardware implants directly into the devices before boxing them back up and returning them to the consumer market. These sophisticated implants were engineered to covertly read users’ seed phrases—the master backup keys required to access cryptocurrency wallets—enabling the remote criminals to quietly drain the devices of their contents.
Describing the operation as one of the most sophisticated attacks the digital asset industry has ever experienced, Ledger has not yet officially disclosed the exact aggregate amount of money lost in the breach. Independent estimates provided by blockchain investigator Specter, however, suggest that as much as $86 million may have been drained from affected users across the region.
And sitting squarely among the high-profile casualties of this supply chain attack, according to Chainalysis, was the very same conman who had previously enriched themselves through the task scam.
In the wake of the breach, Ledger officials stated that the company is actively collaborating with international law enforcement agencies to follow the trail of funds, identify the culprits, and dismantle the infrastructure utilized by the attackers. Furthermore, the company confirmed it has conducted thorough audits to ensure no other authorized vendors or official supply channels have been compromised by the scammers.
Meanwhile, CryptoBilis has reportedly ceased the sale of all Ledger products as the fallout from the investigation continues to unfold.
The incident highlights a growing and troubling trend within the cryptocurrency ecosystem, where hardware wallet users and vendors have increasingly become targets for sophisticated supply chain attacks over the course of the year. Prior to the Ledger compromise, the digital asset community reeled from a massive security incident in July that targeted users of popular Coldcard hardware devices.
In that earlier attack, crooks managed to steal close to $120 million in bitcoin from Coldcard users. The vulnerability stemmed from a firmware bug that compromised the randomness of the device’s seed generation process, inadvertently allowing external hackers to mathematically guess and reconstruct investor seed phrases. As hardware wallets continue to be viewed as the gold standard for self-custody and cryptocurrency security, these successive high-level attacks underscore the escalating challenges facing manufacturers, security researchers, and digital asset holders worldwide.
