Task Scam Mastermind Loses Approximately $4.8 Million in Bitcoin from Ledger Theft Incident

Funds from Scam Targeting Another Criminal Group

Blockchain analysis firm Chainalysis has revealed that one of the biggest victims of the theft involving the compromised Ledger device was the mastermind behind a task scam.

One of the biggest victims of the Ledger theft was a scammer themselves. They lost more than 60BTC, about $4.8M. The funds were from a task scam. In this task scam, people were paid to fake sales and reviews of real items. Then a "negative balance" appeared, and they were told to add their own money in order to get paid. On Sep 22, the person behind the scam moved the proceeds into three separate Ledger addresses. On Oct 9, thieves emptied all three. One transfer each, into the same wallet. The wallet is reported as stolen funds.

--- Chainalysis (@chainalysis) October 15, 2026

The largest victim of the Ledger theft included the scammer themselves, who lost over 60BTC, approximately $4.8 million. The funds were from a task scam.

In this task scam...

The total loss amounted to over 60BTC, about $4.8 million (approximately 760 million yen), resulting in an ironic situation where profits from the scam were lost in another theft incident.

Outflow of Funds from Three Addresses Holding Scam Proceeds

According to Chainalysis, the victim was involved in a task scam that offered rewards to people for creating fake sales and reviews of real products.

As participants progressed with the tasks, their account balances turned negative, and they were asked to add their own funds to receive their rewards. The mastermind of the scam transferred the proceeds to three different Ledger addresses on September 22. However, on October 9, the perpetrators withdrew all funds from the three addresses, moving them to the same wallet in a single transfer each. This wallet is reported to hold stolen funds.

The diagram of the fund movements released by Chainalysis shows that the scam proceeds were sent through a wallet that collected the funds to the three Ledger addresses, with approximately $1.64 million withdrawn from each address.

The FTC (Federal Trade Commission) estimates that about 40% of the job scams reported in 2024 were task scams. Additionally, the losses from job scams involving cryptocurrency reached $41 million (approximately 6.5 billion yen) in the first half of 2024, indicating that cryptocurrency has become the most preferred payment method in such scams.

Unauthorized Components in Ledger Devices, Total Damage Under Investigation

In this theft incident, it is reported that a criminal group purchased legitimate Ledger devices and installed unauthorized hardware implants to steal recovery phrases, selling them through resellers in Southeast Asia.

Ledger's security team, Donjon, confirmed that the devices read the screen during initial setup, capturing the displayed 24-word recovery phrase and sending it externally via LTE through eSIM. According to Ledger, all confirmed loss cases are related to devices sold through the reseller CryptoBilis.

On-chain analyst Specter estimates that the total outflow of Bitcoin (BTC), Ethereum (ETH), and Tron (TRX) combined exceeds $86 million (approximately 13.6 billion yen), but Ledger has not verified this figure, nor has it confirmed the total number of affected users or the total amount of losses.

Ledger explained that there are no defects in the device's chip, operating system, or server, and the system has not been compromised. They are working with law enforcement and the security community to track the funds and dismantle the attackers' infrastructure. Additionally, they are urging users who purchased signed devices from CryptoBilis to migrate their assets to new signed devices with new recovery phrases.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.