A task-scam operator has become one of the largest individual victims of the Ledger hardware-wallet supply-chain attack, losing about 60 Bitcoin worth roughly $4.8 million, according to blockchain intelligence firm Chainalysis.
The scammer transferred the criminal proceeds into three Ledger wallets on September 22. On October 9, the attacker moved all of the Bitcoin to a wallet already known to be used for stolen funds. Chainalysis emphasized that although the scammer suffered the loss, it does not mean the original victims of the task scam recovered their money.
The operator allegedly paid individuals to create fictitious sales and reviews, then told them they had a "negative balance" and prompted them to deposit cash to collect a payout. The FTC described a similar scheme in 2024 and estimated roughly 20,000 task-scam reports in the first half of that year, with job-scam losses exceeding $220 million.
Ledger said criminals purchased genuine devices, hid malicious components inside them, and placed the tampered devices into Southeast Asian distribution channels. The implants were able to retrieve 24-word recovery phrases during setup, allowing remote access to wallets. Ledger maintained that its system remained safe and advised authorized resellers to stop displaying devices publicly and to hand them over only at purchase.
Bitquery estimates the overall loss at $102 million across 324 wallets on TRON, Bitcoin, Ethereum, Solana, BNB Chain, and Polygon, up from about $86 million previously. The affected devices were reportedly obtained through CryptoBilis, a reseller operating in Indonesia, Malaysia, and the Philippines. Investigators traced coordinated movements of stolen funds, including $10 million in USDT that Tether has frozen. Other stolen assets were moved through Tornado Cash and THORChain.
The incident adds to broader crypto security concerns. TRM Labs recorded 207 attacks in the first half of 2026 that stole $972 million. Infrastructure and operational breaches accounted for only 15% of incidents but 76% of total losses. In response, Trezor will cancel authorizations for certain resellers starting January 1, 2027, and OneKey has parted ways with CryptoBilis.
