One of the largest losses in the tampered Ledger device theft appears to have fallen on a scammer, according to blockchain analytics firm Chainalysis.
In a post on X on Thursday, Chainalysis said the victim lost more than 60 BTC, worth about $4.8 million, and that the funds had come from a task scam.
Where the money came from
Task scams recruit people to complete simple online jobs, such as faking sales or writing reviews for real products. Victims are then shown a “negative balance” in their accounts and told to deposit their own money before they can be paid.
How it was drained
According to Chainalysis, the proceeds passed through a consolidation wallet and were then moved into three separate Ledger addresses on 22 September.
On 9 October, all three addresses were emptied, with one transfer from each into the same wallet. That wallet has been reported as holding stolen funds. Each address lost about $1.64 million.
Ledger disclosed the incident on 9 October, the same day.
Chainalysis did not say where the scammer bought the devices.
The wider Ledger investigation
Ledger’s Donjon security team found an implant in devices sold through CryptoBilis, a Southeast Asian reseller. The implant reads the 24-word recovery phrase from the screen during setup and sends it out over a mobile connection.
Ledger has said all confirmed losses involve devices sold through CryptoBilis. On Tuesday, it asked resellers and distributors in six Southeast Asian countries and Hong Kong to suspend sales of its devices.
Onchain investigator Specter has traced more than $86 million in suspected thefts linked to the incident. Ledger says it has not verified that figure.
Ledger had not confirmed the total number of affected users or the value lost at the time of writing, and its investigation is ongoing.
What happens next
The scammer case suggests the attack did not discriminate between victims. Anyone who set up an affected device was exposed, whatever the source of their funds.
The key figures to watch are Ledger’s own count of affected users and losses, and whether any devices bought outside the CryptoBilis channel turn out to be compromised.
