Scammer's Own Stolen Haul Is Drained in $4.8M Ledger Wallet Theft

The unlikely public face of the broader $100 million Ledger theft is a suspected scammer who had roughly $4.8 million drained from a Ledger wallet.

The irony: those funds had themselves been stolen, so a tale about fraud has become a cautionary note on holding crypto.

How the Take From a Scam Was Itself Drained

Job-fraud setups promise quick pay for simple online work, but require a deposit before any withdrawal is released. The sales pitch never changes: complete a small task, receive money, then put up even more to gain access to your earnings. In this case, the people doing the jobs were hit first, with the operation relying on their continued payments.

Chainalysis says the victims were compensated for inventing sales and reviews for actual goods. Afterwards, their account balances went into negative territory, and they were instructed to deposit personal funds to release their earnings.

On September 22, the person running the scheme shifted the profits into three distinct Ledger addresses, and the funds remained there until they were drained.

Those addresses were cleaned out on October 9 with single transfers into one wallet that had previously been flagged for receiving stolen funds. The fraudster's take was removed from their control, eventually landing with the same type of actor the scheme had targeted.

That detail is what keeps this episode from being merely a footnote. The discovery emerged while Chainalysis was tracking the wider Ledger drain, showing how stolen money often moves through wallets with a known history of theft.

Who Bears the Loss When Stolen Funds Are Taken Again?

The fraudster's setback is just one piece of the picture. The larger Ledger drain also touches hardware sold by CryptoBilis, a retailer active across Malaysia, Indonesia and the Philippines.

Regular customers bore the brunt. From roughly October 9, people who had purchased devices from the merchant began reporting empty wallets. Initial figures exceeded $86 million spread over Ethereum, TRON and Bitcoin.

Bitquery later estimated the sum at close to $102 million, with $79.3 million or so on TRON, the bulk in USDT. Bitcoin made up approximately $16.8 million, equivalent to 203.8 BTC.

Ledger advised anyone who had made a CryptoBilis purchase during the preceding 90 days to avoid initializing the hardware. Those who had already done so were urged to transfer assets to a fresh seed phrase. For users, the key is that where a device comes from matters as much as the software running on it.

Ledger reports that verified losses are still confined to Southeast Asia, while spot inspections in Europe, Germany among them, uncovered no compromised units.

Tether, for its part, has frozen about $10 million worth of USDT. Chainalysis, meanwhile, is tracing laundering activity that runs through Tornado Cash, Zcash, bridges and stablecoin conversions.