An alleged cryptocurrency task-scam operator lost more than 60 Bitcoin, worth approximately $4.8 million, in the recent Ledger hardware wallet theft, according to findings attributed to blockchain analytics firm Chainalysis. The disclosure, reported on October 15, 2026, identifies an unusual victim in the wider attack: an individual suspected of collecting cryptocurrency through a fraudulent online employment scheme. According to the investigation, the operator transferred the funds into three separate Ledger wallet addresses on September 22. On October 9, an attacker emptied all three addresses, moving the Bitcoin into a single wallet associated with the broader theft.
The incident forms part of a supply-chain compromise involving modified Ledger devices distributed through Southeast Asian reseller CryptoBilis. Investigators have linked the wider operation to tens of millions of dollars in cryptocurrency losses, although estimates differ across blockchain analytics providers.
Alleged Task-Fraud Proceeds Drained From Three Wallets
Chainalysis reportedly traced the stolen Bitcoin to an operation commonly described as a task scam, in which victims are recruited to perform seemingly straightforward online work. Participants are initially offered payments for activities such as generating product reviews or completing transactions intended to create artificial sales activity. The scheme subsequently introduces account balances that appear negative, requiring participants to deposit their own money before withdrawing supposed earnings. Those additional payments can become the primary source of losses for victims.
According to the reported findings, the suspected operator accumulated cryptocurrency through such activities before moving the proceeds into three Ledger-controlled Bitcoin addresses on September 22. On October 9, each address was drained through a separate transaction, with the funds consolidated into a wallet already associated with stolen cryptocurrency. The combined transfers exceeded 60 BTC, valued at approximately $4.8 million. The available reporting does not establish the operator’s identity, location or whether authorities have initiated criminal proceedings. It also does not confirm whether any of the stolen Bitcoin has subsequently been recovered.
Ledger Supply-Chain Attack Raises Hardware Security Concerns
The theft occurred amid a broader investigation into compromised Ledger hardware wallets sold through CryptoBilis. On October 13, Ledger disclosed that investigators had identified unauthorized electronic components installed inside affected devices. The implants reportedly captured users’ 24-word recovery phrases when displayed during wallet initialization and transmitted the information through cellular connectivity using LTE and embedded SIM technology. Possession of a recovery phrase allows an attacker to recreate a cryptocurrency wallet and transfer its assets without physically accessing the original device.
Ledger said the attack involved physical modification of hardware rather than a compromise of its internal systems or the devices’ secure elements. Blockchain investigators have published differing loss estimates, ranging from approximately $86 million to more than $100 million. CoinDesk reported on October 12 that Tether had frozen $10 million in USDT associated with the attack. Ledger advised customers who purchased affected devices through CryptoBilis not to initialize unused wallets. Customers who had already configured devices were urged to transfer their assets to newly generated recovery phrases using trusted hardware. The company’s investigation into the distribution and modification of affected devices remains ongoing.
The reported theft from an alleged scam operator illustrates how compromised wallet infrastructure can expose cryptocurrency holders regardless of the origin of their funds. However, the operator’s alleged involvement in fraud does not establish the identity or motives of the hardware-wallet attackers. The case also demonstrates the limitations of self-custody security when physical devices are compromised before reaching customers. Further blockchain tracing may clarify whether the stolen Bitcoin can be recovered and how the funds connect to the wider CryptoBilis operation.