Bitcoin Scammer Loses $4.8 Million to Tampered Hardware Wallets

A crypto scammer who made money by manipulating ordinary people has now landed on the wrong side of a remarkably sophisticated Bitcoin theft.

Blockchain analytics firm Chainalysis says one of the largest known victims of the tampered-hardware-wallet scheme lost more than 60 BTC, worth roughly $4.8 million at the time. The money had come from a so-called task scam, in which victims were paid to create fake sales or reviews before a supposed negative balance forced them to deposit their own cash to continue.

Decrypt reports that the operator moved the proceeds into three separate hardware-wallet addresses on September 22. On October 9, each address was drained into the same destination wallet, which had already been associated with stolen funds.

Each transfer was worth about $1.64 million. Chainalysis traced the Bitcoin back to a task scam that initially paid people to create fake product sales and reviews, then showed them a negative account balance and demanded deposits before their supposed earnings could be released.

The transaction trail showed the scam proceeds moving through a consolidation wallet before reaching the three compromised addresses. That makes this more than a strange reversal of fortune: the same transparency that lets investigators follow stolen Bitcoin also exposed how the original fraud operated.

Ledger disclosed the hardware-wallet incident on October 9. An independent on-chain investigator has associated more than $86 million in suspected thefts with the broader scheme, although Ledger says it has not verified that total.

One of the biggest victims of the Ledger theft was a scammer themselves. They lost more than 60BTC, about $4.8M. The funds were from a task scam.

In this task scam, people were paid to fake sales and reviews of real items. Then a "negative balance" appeared, and they were told… https://t.co/IJX4tx9ib3 pic.twitter.com/pGXNJkZJUi

— Chainalysis (@chainalysis) October 15, 2026

A hardware wallet can protect private keys from online attacks only if the device itself can be trusted. In this case, the secret recovery words were exposed during the wallet’s own setup process.

Once an attacker compromises that physical supply chain, the wallet becomes the attack.

CoinDesk’s account of Ledger’s investigation says the company’s Donjon security team found an unauthorized hardware implant inside devices sold by Southeast Asian reseller CryptoBilis. The implant could read the 24-word recovery phrase as it appeared on the device during setup.

The stolen words were then transmitted over a cellular connection, bypassing the protections people expect from an offline signing device. The attack did not require malware on the owner’s computer or a fake web page once the compromised hardware was in hand.

Ledger confirmed the implant after examining a device connected to one affected user. The company said its investigation remained active and warned customers to obtain devices only through trusted distribution channels.

Update from Ledger Donjon on the CryptoBilis investigation 🔽@DonjonLedger is investigating Ledger signers sold by CryptoBilis, a reseller in Southeast Asia, that contained an unauthorized hardware implant. Ledger confirmed this on October 10th for one affected user's signer.…

— Ledger (@Ledger) October 13, 2026

Ledger has said every confirmed loss so far is tied to devices sold through CryptoBilis. Chainalysis did not say where the task-scam operator bought the affected wallets.

Ledger has not confirmed the total number of victims or the total amount stolen. The company has asked distributors in several Southeast Asian markets and Hong Kong to suspend sales while the investigation continues.

For Bitcoin holders, the practical rule is brutally simple: buy security devices directly from the manufacturer or a clearly authorized seller, inspect packaging carefully, and never assume that a device is safe merely because it powers on and looks legitimate. Self-custody removes one class of counterparty risk, but only when the custody hardware itself is genuine.

Join the conversation!

We have no tolerance for comments containing violence, racism, profanity, vulgarity, doxing, or discourteous behavior. If a comment is spam, instead of replying to it please click the icon below and to the right of that comment. Thank you for partnering with us to maintain fruitful conversation.