Scammer loses $5M in bitcoin to Ledger thieves in twist of fate

Blockchain analysts say one of the largest victims of last week's Ledger theft was actually a scammer, who lost close to $5 million in bitcoin.

Chainalysis stated on Thursday that a criminal had lost 60 bitcoins — roughly $4.8 million — that had been obtained through a task scam.

The address, Chainalysis explained, was tied to a scheme that paid individuals to fabricate sales and reviews of real products. They were told to add their own money to receive payment, and then that money was stolen.

One of the biggest victims of the Ledger theft was a scammer themselves. They lost more than 60BTC, about $4.8M. The funds were from a task scam.

In this task scam, people were paid to fake sales and reviews of real items. Then a "negative balance" appeared, and they were told… https://t.co/IJX4tx9ib3

— Chainalysis (@chainalysis) October 15, 2026

However, the individual behind the task scam had moved the stolen funds into Ledger wallet addresses, which were subsequently hit by other scammers last week.

Chainalysis reported: "On Sep 22, the person behind the scam moved the proceeds into three separate Ledger addresses." The analyst added that on Oct 9, all three were emptied, each with a single transfer into the same wallet, which is listed as stolen funds.

Ledger, headquartered in Paris, announced last week that it had launched an investigation after customers in Southeast Asia reported losing funds following purchases from a Malaysian reseller called CryptoBilis.

The company later described the scheme as a large-scale organized crime effort in which implants were placed inside devices before they were resold. These implants were capable of reading users' seed phrases, allowing criminals to drain wallets.

Ledger has labeled the incident one of the most "sophisticated attacks" ever seen in the digital asset space, but has not disclosed the total loss. Blockchain investigator Specter, however, has estimated that $86 million was taken.

According to Chainalysis, the task scam perpetrator was among those who lost funds.

Ledger has stated it is cooperating with law enforcement to "follow the funds and dismantle the attackers' infrastructure," and confirmed that no other vendors have been affected.

The company noted that CryptoBilis has ceased selling Ledger products.

This year has seen multiple attacks on bitcoin hardware vendors, including a major incident in July targeting Coldcard devices.

Approximately $120 million in bitcoin was stolen from Coldcard users due to a firmware bug that caused faulty seed generation, enabling hackers to guess investors' seed phrases.