Ledger: An Alleged Scammer Gets $4.8 Million in Bitcoins Stolen

An alleged scammer is among the main victims of recent thefts affecting Ledger wallets. Chainalysis reveals on October 15 that an operator suspected of organizing a scam involving fake paid tasks lost over 60 bitcoins, approximately 4.8 million dollars. The funds had been distributed across three addresses before being stolen on October 9. The case takes an unexpected turn: the stolen bitcoins are themselves reportedly from a scam.

An alleged scammer loses 60 bitcoins in the Ledger case

Chainalysis has just identified an unexpected victim of the thefts that occurred on October 9. The blockchain analysis company states that an operator suspected of scamming lost more than 60 BTC in this attack. The case occurs as Ledger confirmed the presence of a spy device in certain wallets, especially among devices distributed in Southeast Asia.

The bitcoin movements traced by Chainalysis date back to September 22. On that day, the operator suspected of scamming reportedly transferred his funds to three distinct Bitcoin addresses, associated with Ledger wallets. The device was probably intended to keep the assets away from exchanges. The funds remained on these addresses for a little over two weeks.

On October 9, the funds disappeared. Three transactions were enough to empty the three addresses and transfer the bitcoins to the same wallet, already linked to other thefts. In total, more than 60 BTC changed hands, for an estimated value of 4.8 million dollars according to Chainalysis.

The identity of the operator was not made public. No information is available that confirms he was prosecuted. However, the analysis company believes the bitcoins held on these addresses came from fraudulent activity.

The bitcoins originated from a fake job scam

The origin of the funds makes this case particular. Chainalysis links the bitcoins to a scam called task scam, or fake paid tasks scam. The principle is to offer simple tasks to internet users. Participants must notably post fake reviews on products or simulate purchases to artificially boost their commercial reputation.

At first, the promised payments seem accessible. Victims may even receive small payments to convince them to continue. Then the operation changes. The platform suddenly shows a negative balance. To recover their earnings or finish their tasks, participants must deposit their own money.

Some make multiple deposits hoping to unlock their payment. The promised earnings are never paid. This mechanism is well documented by the U.S. Federal Trade Commission. In an alert published in August 2025, the authority explained that fraudsters often demanded crypto deposits to unlock fictitious commissions.

The operator identified by Chainalysis would have used this type of device to accumulate funds then converted or kept in bitcoins. The 60 BTC do not necessarily correspond to his own savings. They would represent part of the proceeds of the scam. Their theft by another criminal group does not mean that the people initially scammed recovered their money. No reimbursement has been confirmed.

Ledger faces the consequences of the attack

The theft of 60 bitcoins is part of a much larger case. Since October 9, several Ledger wallet users have reported the disappearance of their assets. Investigations revealed that some devices had been physically modified before delivery.

Hidden electronic components made it possible to recover users’ recovery phrases during setup. The information could then be transmitted remotely via a mobile connection.

The manufacturer asserts that its servers, operating system, and secure chips were not compromised. The attack concerned the distribution of some authentic devices, modified after they left the channels controlled by Ledger. In response to these discoveries, Trezor also announced a tightening of its reseller network, with changes scheduled from January 2027.

For its part, Ledger asked its distributors to reinforce stock controls and to no longer resell returned devices.

The company is also cooperating with authorities to track the stolen funds. The total losses remain difficult to establish. Several independent estimates mention tens of millions of dollars, some exceeding 90 million. However, Ledger has not confirmed a definitive amount.

As early as October 10, Changpeng Zhao warned about risks related to physical manipulation of Ledger wallets. The identification of the alleged scam operator now provides additional information about the victims. The Bitcoin blockchain allows tracking of transfers made between addresses. However, it alone is not sufficient to establish the identity of people involved or to restore the funds. For the initial victims of the fake paid tasks scam, the 4.8 million dollars therefore remain out of reach.