A bitcoin thief who allegedly ran a task scam was among the victims of last week’s Ledger-related theft, losing 60 BTC worth about $4.8 million, according to blockchain analytics firm Chainalysis and reporting by Bitcoin Magazine.
How the funds were stolen
Chainalysis said the bitcoin had originally been taken through a so-called task scam. In this type of scheme, victims are offered payments for carrying out activities such as creating fake sales or product reviews. They are then asked to deposit their own money to unlock or receive the promised earnings, after which the funds are stolen.
The analyst linked the affected address to the operator of such a con. On September 22, the scam proceeds were moved into three separate addresses associated with Ledger hardware wallets, Chainalysis said. On October 9, thieves emptied all three addresses, sending one transfer from each to the same wallet. That wallet has since been identified in reports as holding stolen funds.
The incident means the operator of the original fraud lost the bitcoin after placing it in wallets later targeted by another criminal group. The case highlights how stolen cryptocurrency can move through multiple criminal operations while remaining visible on a public blockchain.
What Ledger says about the attack
Paris-based Ledger began investigating after customers in Southeast Asia reported losing funds following purchases from CryptoBilis, a Malaysia-based reseller. Ledger later described the incident as a large, organized operation in which criminals allegedly installed implants in devices and returned them to the market.
According to Ledger, the implants could read users’ seed phrases. A seed phrase is the sequence of words that can restore access to a cryptocurrency wallet; anyone who obtains it may be able to control the assets held there.
Ledger has called the incident one of the digital-asset industry’s most sophisticated attacks. The company has not disclosed the total amount lost. Blockchain investigator Specter, however, said that $86 million had been drained. Ledger said it was working with law enforcement to trace the funds and dismantle the attackers’ infrastructure, and that it had confirmed no other vendors had been targeted. CryptoBilis has stopped selling Ledger products.
Wider hardware-wallet risks and market picture
The Ledger case follows another major incident involving bitcoin hardware sellers. In July, criminals reportedly stole close to $120 million in bitcoin from Coldcard users after a firmware bug caused faulty seed generation, making it possible for hackers to guess seed phrases.
Moneyiar market data at 21:59 on October 17, 2026, showed Bitcoin at $80,986.59, down 0.73% over 24 hours and 2.40% over seven days. JUST was $0.135525, down 0.17% in 24 hours and 0.89% over seven days. edgeX stood at $0.293697, down 3.13% and 18.34%, respectively, while Aethir was $0.0054399, down 4.82% over 24 hours and 18.06% over seven days.
