A crypto scammer who made millions through fake online job offers lost more than $4.9 million in bitcoin after thieves compromised Ledger hardware wallets, according to blockchain analytics firm Chainalysis. The theft was linked to devices sold by Southeast Asian reseller CryptoBilis that contained unauthorized implants capable of transmitting wallet recovery information over a mobile network.
How the Spy Chip Worked
Ledger’s Donjon security team found that wallets sold through CryptoBilis contained an implant that reads the 24-word recovery phrase from the screen during setup and sends it out over LTE. Attackers could then use the phrase to access and drain the wallets remotely. The company said the perpetrators purchased genuine devices, installed the hidden components, and reintroduced the tampered products into Southeast Asian distribution channels. Ledger maintained that its secure chip, operating system, and servers were not compromised, and that all confirmed losses involve devices sold through CryptoBilis.
The Scammer’s Role and the Theft
Chainalysis said the scammer transferred proceeds from their scheme to three wallet addresses, from which attackers stole 60 bitcoin. The person behind the operation had collected the bitcoin through a so-called task scam involving fake product reviews. People were initially paid small amounts to fabricate product reviews or boost online sales. Once trust was established, they were told their accounts showed a negative balance and that they must deposit their own money before withdrawing supposed earnings. On September 22, the scammer moved the illicit proceeds into three separate Ledger addresses. On October 9, thieves emptied all three addresses with one transfer each, consolidating the funds into a single wallet. Each address was drained of approximately $1.64 million, totaling about $4.8 million in bitcoin.
Industry Response and Wider Context
Ledger instructed authorized resellers to stop displaying devices openly and to provide them only at the time of purchase following the incident. The company also paused sales in seven regional markets, including Hong Kong, while reviews continue. Rival hardware wallet makers have taken their own steps. Trezor announced it would cancel authorizations for certain resellers effective January 1, 2027. OneKey ended its relationship with CryptoBilis entirely. Former Binance CEO Changpeng Zhao commented on X that there was no evidence of widespread vulnerability and that the attack appeared limited to items sold through specific resellers. Bitquery estimated that approximately $102 million was stolen from 324 wallets across six blockchains including Bitcoin, Ethereum, TRON, Solana, BNB Chain, and Polygon. TRM Labs reported 207 crypto attacks during the first half of 2026, resulting in $972 million in losses, with infrastructure and operational breaches accounting for just 15% of those incidents but 76% of total losses.
Recovery Efforts and Unverified Losses
Ledger disclosed the incident on October 9, prompting immediate action from its security team. The company instructed authorized resellers to stop displaying devices openly and to provide them only at the time of purchase following the incident. Additionally, Ledger paused sales in seven regional markets, including Hong Kong, while reviews continue. These measures aim to prevent further distribution of compromised units within Southeast Asian channels.
Rival hardware wallet manufacturers have also taken decisive steps to address supply chain risks. Trezor announced it would cancel authorizations for certain resellers effective January 1, 2027. OneKey ended its relationship with CryptoBilis entirely. These actions reflect a broader industry response to the vulnerability exposed by the tampered devices.
While Ledger confirmed losses tied specifically to CryptoBilis, independent analysts have reported wider figures that remain unverified by the manufacturer. Onchain investigator Specter traced more than $86 million in suspected thefts, a figure Ledger says it has not verified. Bitquery estimated that approximately $102 million was stolen from 324 wallets across six blockchains including Bitcoin, Ethereum, TRON, Solana, BNB Chain, and Polygon. Tether subsequently froze $10 million in USDT identified as part of coordinated fund movements.
Sources
- Scammer who duped job seekers loses $4.9 million in bitcoin to Ledger spy-chip exploit
- Scammer Lost $4.8M in Bitcoin to Tampered Ledger Wallets: Chainalysis – Decrypt
- Crypto Scammer Loses 60 Bitcoin to Attackers Who Tampered With Ledger Wallets — BigGo Finance
Photo: rc.xyz NFT gallery / Unsplash (Unsplash License)
