Chainalysis: One of the Victims of the Ledger Wallet Theft Turned Out to Be a Scammer

Published: October 16, 2026 – 08:30 UTC

According to Chainalysis, more than 60 BTC worth about $4.8 million, stolen from three Ledger wallets, originated from a task scam.
The scheme’s operator transferred the funds to three addresses on September 22, and on October 9 all three wallets were drained.

Chainalysis analysts reported that one of the biggest victims of the theft from Ledger wallets turned out to be the organizer of a fraudulent scheme. More than 60 BTC were stolen from their wallets, valued at roughly $4.8 million.

One of the biggest victims of the Ledger theft was a scammer themselves. They lost more than 60BTC, about $4.8M. The funds were from a task scam.In this task scam, people were paid to fake sales and reviews of real items. Then a "negative balance" appeared, and they were told to add their own money in order to get paid.On Sep 22, the person behind the scam moved the proceeds into three separate Ledger addresses. On Oct 9, thieves emptied all three. One transfer each, into the same wallet. The wallet is reported as stolen funds.
— Chainalysis (@chainalysis) October 15, 2026

According to the analysts, the stolen bitcoin was obtained through a so-called task scam. Under this scheme, people were recruited to create fake sales and reviews for real products. Later, they were shown a “negative balance” and asked to deposit their own funds to receive the promised payout.

On September 22, the scheme’s operator transferred the funds to three separate Ledger addresses. On October 9, the attackers drained all three wallets, making one transaction from each to the same address. Chainalysis flagged the receiving wallet as linked to stolen funds.

Ledger Explained the Attack Mechanism

According to a statement from Ledger, a criminal group spent several months buying genuine devices, opening them up, and installing hidden components to intercept seed phrases during setup. The devices were then put back on sale via resellers in Southeast Asia.

Ledger said it found no vulnerabilities in the chips, the operating system, or its own servers. According to the company, the attackers compromised the devices only after they had left its control.

The manufacturer reported that it is inspecting devices in warehouses and retail stores, and has suspended sales via authorized partners in Southeast Asia and Hong Kong. The company also tightened its distribution rules: returned devices are prohibited from being resold, and products can no longer be placed on open shelves and display cases.

Ledger is working with law enforcement and cybersecurity experts to trace the funds and dismantle the attackers’ infrastructure.

As a reminder, Ledger recently unveiled the Atom crypto wallet for Android.

Сообщение Chainalysis: One of the Victims of the Ledger Wallet Theft Turned Out to Be a Scammer появились сначала на INCRYPTED.

Source: Incrypted