Scammer Gets Scammed: Ledger Implant Thieves Steal $4.8M in Bitcoin

Chainalysis has revealed that one of the biggest victims of the Ledger implant thefts was a task scam operator who lost more than 60 Bitcoin (BTC).

The blockchain analytics firm put that loss at about $4.8 million. It seems the operator moved the scam’s proceeds into three Ledger addresses on September 22, and then emptied all three into the same wallet on October 9.

A flow chart Chainalysis posted traces the money back to a consolidation wallet, and it labels three of the wallets feeding it as reported scams. Likewise, the largest scam wallet sent it $1.36 million across 106 transfers. Each Ledger address was then drained of about $1.64 million in a single transfer.

Fake Reviews Led to Deposits

The report said the scam paid people to fake sales and reviews of real products, who then saw a negative balance appear in their accounts. They were told to add their own money before they could be paid.

One of the biggest victims of the Ledger theft was a scammer themselves. They lost more than 60BTC, about $4.8M. The funds were from a task scam.

In this task scam, people were paid to fake sales and reviews of real items. Then a “negative balance” appeared, and they were told to add their own money in order to get paid.

On Sep 22, the person behind the scam moved the proceeds into three separate Ledger addresses. On Oct 9, thieves emptied all three. One transfer each, into the same wallet. The wallet is reported as stolen funds.

— Chainalysis (@chainalysis) October 15, 2026

The US Federal Trade Commission (FTC) described the same pattern in a December 2024 report on task scams. The agency estimated that task scams made up nearly 40% of job scam reports in 2024.

“Cryptocurrency is the payment of choice for these scams,” the FTC said. Reported crypto losses to job scams hit $41 million in the first half of 2024, the agency added.

Ledger Ties Losses to CryptoBilis

Chainalysis didn’t disclose where the operator bought the Ledger signers, but Ledger has tied every confirmed loss from the incident it disclosed on October 9 to signers sold through CryptoBilis, a Southeast Asian reseller.

On October 10, Ledger found an unauthorized hardware implant inside one victim’s signer. Its Donjon security team said the implant reads the screen during setup and captures the 24-word recovery phrase. The implant then sends those words out over LTE through a provisioned eSIM.

On-chain analyst Specter has estimated losses from the CryptoBilis drain at more than $86 million, across Bitcoin, Ethereum (ETH) and TRON (TRX).

“We have not confirmed the total number of affected users or the total value lost,” Ledger said on Tuesday. The company has told anyone who set up a signer bought from CryptoBilis to move their assets to a new signer with a new recovery phrase.