A person behind a task scam lost more than 60 Bitcoin—worth approximately $4.8 million at the time of the theft—after funds were placed in three Ledger wallet addresses that were later drained, according to blockchain analytics firm Chainalysis.
How the theft unfolded
Chainalysis said the Bitcoin originated from a task scam, a scheme in which victims are paid to carry out artificial sales or post fake reviews for genuine products. The arrangement later showed a negative balance in the victims’ accounts, and they were told to deposit their own money to recover payment.
The scammer moved the proceeds into three separate Ledger addresses on September 22. On October 9, thieves emptied each address, sending one transfer from each into the same wallet, which has been identified as holding stolen funds. Chainalysis said each Ledger address contained about $1.64 million when it was drained. The funds had passed through a consolidation wallet before being distributed among the three addresses.
The disclosure created an unusual element in the wider theft: one of the largest identified victims was allegedly involved in criminal activity themselves. Chainalysis detailed the transactions in a post on Thursday, October 15, as reported by Decrypt.
Ledger’s investigation into tampered devices
Ledger disclosed the broader incident on October 9. The company’s Donjon security team said it had discovered an implant in devices sold through Southeast Asian reseller CryptoBilis. According to Ledger, the implant reads a wallet’s 24-word recovery phrase from the screen during setup and transmits it over LTE.
Ledger has said every confirmed loss connected with the incident involved devices sold through CryptoBilis. Chainalysis did not establish where the scammer bought the wallets, so the source of those particular devices has not been identified.
An onchain investigator known as Specter has attributed more than $86 million in suspected thefts to the incident, although Ledger has said it has not verified that figure. Ledger has asked resellers and distributors in six Southeast Asian countries and Hong Kong to pause sales of its devices. The company has not confirmed the total number of affected users or the total value lost, and its investigation remains in progress.
Bitcoin market picture
Moneyiar market data at 21:54 on October 17, 2026, showed Bitcoin at $81,061.98, down 0.65% over 24 hours and 2.31% over seven days. At the reported market price, 60 BTC would be worth roughly $4.86 million, although the value cited by Chainalysis was approximately $4.8 million when the theft was reported.
