A cryptocurrency fraudster who allegedly collected millions of dollars through fake online employment offers lost more than $4.9 million in bitcoin after attackers compromised Ledger hardware wallets holding the proceeds.
How the bitcoin was stolen
Blockchain analytics company Chainalysis said the scammer moved funds linked to the operation into three Ledger wallet addresses. Attackers later emptied those addresses, taking 60 bitcoin.
The case involved a so-called task scam. Victims were first offered online work, such as posting fabricated product reviews or helping boost sales figures. After they appeared to earn money, they were told their accounts had fallen into a negative balance and that they needed to deposit their own funds before withdrawing the supposed earnings.
According to CoinDesk, Chainalysis identified the person behind that scheme as one of the largest victims of a separate compromise affecting certain Ledger devices.
The CryptoBilis connection
The stolen funds were held on Ledger hardware wallets sold by Southeast Asian reseller CryptoBilis. Investigators found that some of the devices contained unauthorized hardware implants.
Those implants were capable of sending wallet recovery information over a mobile network. Recovery information, often called a seed phrase, can be used to restore access to a cryptocurrency wallet. If an attacker obtains it, the assets controlled by that wallet may be exposed even when the physical device remains with its owner.
The incident therefore involved two layers of wrongdoing: proceeds gathered through a fake-job fraud were stored in hardware wallets that had been compromised before the theft. The attackers used access obtained through the affected devices to remove the bitcoin.
Why hardware-wallet security matters
Hardware wallets are physical devices designed to keep cryptocurrency credentials separate from internet-connected computers and phones. Their security depends not only on software but also on the integrity of the device and the supply chain through which it was sold.
The CryptoBilis case highlights the risk posed by unauthorized modifications before a wallet reaches its user. In this incident, the devices were reportedly capable of transmitting the information needed to recover the wallets, turning a tool intended to protect digital assets into a route for stealing them.
Bitcoin market picture
Moneyiar market data at 21:34 on October 17, 2026, showed bitcoin at $80,923.35, down 0.89% over 24 hours and 2.5% over seven days. Other tracked assets were also lower: Plasma was $0.07867816, down 5.42% in 24 hours and 10.62% over seven days; Compound was $21.26657501, down 3.84% and 14.67%, respectively; and edgeX was $0.295398, down 2.26% over 24 hours and 18.11% over seven days.
