Call it poetic justice: one of the biggest victims of last week’s Ledger theft happened to be a scammer themself, according to blockchain analysts, and lost nearly $5 million in bitcoin. In a post published on Thursday, blockchain intelligence firm Chainalysis revealed that an anonymous cybercriminal lost 60 bitcoins, valued at approximately $4.8 million, which they had previously stolen via a so-called task scam.
According to Chainalysis, the cryptocurrency address was directly linked to a deceptive consumer con where everyday individuals were lured in with promises of payment for executing fake sales and boosting reviews of real retail items online. Victims of this initial scheme were instructed to deposit their own personal funds into the system under the guise of unlocking higher tiers of earnings or clearing negative balances, only to have their assets systematically stolen by the operators.
However, the mastermind behind this sophisticated task scam made a critical error by consolidating and moving their ill-gotten gains into vulnerable Ledger hardware wallet addresses. These specific addresses were subsequently targeted and compromised by an entirely different group of scammers the very following week, illustrating a dramatic instance of criminal vulnerability within the digital asset ecosystem.
On September 22, the individual behind the task scam moved the stolen proceeds into three separate Ledger addresses. On October 9, opportunistic thieves completely emptied all three addresses in a single coordinated transfer each, routing the stolen funds directly into a single designated wallet that has since been publicly flagged and reported as containing stolen funds.
The incident is tied to a broader, highly disruptive security crisis involving Paris-based hardware wallet manufacturer Ledger. Last week, the company confirmed that it had launched an immediate internal investigation after numerous customers located in South East Asia reported sudden and unauthorized losses of their cryptocurrency funds after purchasing devices from a Malaysia-based authorized reseller known as CryptoBilis.
Ledger has since disclosed that the security breach was part of a massive, highly organized criminal operation. Perpetrators managed to compromise the supply chain by physically installing malicious hardware implants directly into genuine devices before resealing them and placing them back onto the open market through retail channels. These sophisticated implants were designed to covertly read users’ private seed phrases as they were generated and initialized, transmitting the critical recovery data back to the criminals so they could subsequently drain the hardware wallets remotely at a later time.
Describing the incident as one of the most sophisticated attacks the digital asset industry has ever experienced, Ledger has not yet officially revealed the total aggregate amount of money lost across all affected users. However, independent blockchain investigators, including prominent analyst Specter, estimate that an astonishing $86 million in digital assets has been drained from unsuspecting victims worldwide as a result of the supply chain compromise.
And the task scam conman, according to the granular tracking provided by Chainalysis, was unfortunately swept up as one of the largest individual casualties of the broader exploit.
In response to the crisis, Ledger has emphasized that it is actively collaborating with international law enforcement agencies to trace the illicit transaction paths, follow the funds across blockchain networks, and completely dismantle the underlying infrastructure utilized by the attackers. Furthermore, the company has conducted extensive audits to confirm and ensure that no other authorized vendors or official distribution channels have been compromised by the scammers.
Meanwhile, CryptoBilis has taken immediate action, announcing that it has completely ceased the sale of all Ledger products to protect its customers and cooperate fully with ongoing investigations.
This multi-million-dollar supply chain attack highlights a troubling and growing trend of criminals shifting their focus toward hardware wallet distributors and manufacturers this year. The Ledger breach follows another massive, industry-shaking attack that took place in July targeting users of the popular Coldcard hardware-signing devices.
During the July incident, malicious actors were able to steal close to $120 million in bitcoin from Coldcard users. That particular security breakdown occurred because the hardware devices suffered from a critical firmware bug that led to faulty, predictable pseudo-random seed generation, ultimately allowing sophisticated hackers to mathematically guess investor seed phrases and compromise long-term cold storage accounts.
As digital asset security firms and hardware manufacturers grapple with these increasingly complex supply chain vulnerabilities, the recent Chainalysis findings serve as a stark reminder that even sophisticated cybercriminals operating within the cryptocurrency space are ultimately susceptible to the very same web of exploits, betrayals, and systemic risks plaguing the broader ecosystem.
