Chainalysis has revealed that one of the largest victims of the Ledger hardware-wallet implant thefts was itself a crypto scam operator, losing more than 60 Bitcoin (BTC) worth approximately $4.8 million. According to the blockchain analytics firm, the scammer moved proceeds from a task scam into three separate Ledger addresses on September 22, and all three were drained into the same wallet on October 9 — each losing about $1.64 million in a single transfer.
The stolen funds were traced back to a consolidation wallet linked to reported scam wallets. The largest scam wallet had sent $1.36 million across 106 transfers. The underlying task scam paid people to fake sales and reviews of real products; victims then saw a “negative balance” and were told to add their own money before they could be paid. The U.S. Federal Trade Commission described the same pattern in a December 2024 report, estimating task scams accounted for nearly 40% of job scam reports in 2024, with reported crypto losses to job scams reaching $41 million in the first half of that year.
Ledger tied confirmed losses to devices sold through CryptoBilis, a Southeast Asian reseller. On October 10, Ledger’s Donjon security team found an unauthorized hardware implant inside one victim’s signer that reads the screen during setup and captures the 24-word recovery phrase, then transmits it over LTE via a provisioned eSIM. On-chain analyst Specter has estimated total losses from the CryptoBilis drain at more than $86 million across Bitcoin, Ethereum (ETH) and TRON (TRX). Ledger has not confirmed the total number of affected users or total value lost and has advised anyone who set up a signer bought from CryptoBilis to move assets to a new signer with a new recovery phrase.
Former Mt. Gox CEO Mark Karpelès has announced a project to create an inexpensive detector for spy implants in Ledger wallets. The device would use low-power radio signals and resonance testing to spot unauthorized antenna components without opening the wallet. Karpelès says he will publish the printed circuit board design and technical specifications so anyone can build it. Ledger also said its security chips, OS and servers were not hacked, and that criminals compromised devices after they left Ledger’s control; the company is imposing stricter reseller rules, including banning resellers from selling returns and keeping products out of public display until purchased.
