Ledger Supply-Chain Theft Exposes Task-Scam Funds and Conflicting Totals
By Coinvote
A task-scam operator lost about $4.8 million in Bitcoin after funds entered addresses associated with tampered Ledger wallets, according to reporting citing Chainalysis. The case exposes a recovery-phrase theft mechanism, while differing accounts of the wider losses leave the incident’s overall scale unresolved.
Task-scam proceeds became another theft target
An operator behind a task scam became a victim of hardware-wallet thieves, losing about $4.8 million in Bitcoin, according to Decrypt’s account of Chainalysis findings. The blockchain analytics firm traced the funds to a scheme that initially rewarded participants for fabricating product sales and reviews.
Participants were subsequently shown an account deficit and instructed to deposit their own money before receiving payment, Decrypt reported. That detail matters because the Bitcoin taken from the wallet addresses represented proceeds attributed to an earlier fraud, rather than an unrelated holder’s savings.
Cointelegraph also reported the loss, describing newly purchased Ledger devices containing spyware. The central finding shared by the outlets is the movement of task-scam proceeds into wallet addresses that were later drained into a common destination.
The transaction trail separates funding from the drain
Decrypt adds a transaction chronology that helps distinguish the original fraud from the subsequent wallet theft. According to its reporting, the operator transferred the proceeds into three Ledger-associated addresses on September 22, and thieves emptied those addresses on October 9.
The Chainalysis chart described by Decrypt shows a consolidation wallet preceding the transfers into those addresses. Each address then sent funds to the same receiving wallet, which Decrypt says has been reported as holding stolen assets.
The accounts differ slightly in their Bitcoin descriptions. Decrypt reports more than 60 BTC, while Cointelegraph gives 60 Bitcoin; both describe the loss as approximately $4.8 million. These are reported valuations, not a basis for revaluing the theft using current Bitcoin prices.
- Decrypt reports that each of the three addresses was drained of about $1.64 million.
- September 22 marks the reported movement into the Ledger-associated addresses.
- October 9 marks the reported transfers out to the common destination.
The implant targeted wallet setup, not just storage
Ledger’s Donjon security team found an implant in devices distributed through Southeast Asian reseller CryptoBilis, according to Decrypt. The implant captured the 24-word recovery phrase as it appeared on the device screen during setup and transmitted it through LTE.
A recovery phrase is the secret that allows a wallet to be restored. Hardware isolation cannot preserve exclusive control if an attacker obtains that secret during initialization, which makes the reported setup-stage interception central to understanding the incident.
Decrypt says Ledger linked all confirmed losses to devices sold through CryptoBilis, but Chainalysis did not identify where the task-scam operator purchased the devices. That distinction prevents the transaction trail from independently establishing the operator’s purchase channel.
The wider loss estimates remain materially different
Cointelegraph reports that tampered devices introduced through the supply chain were associated with more than $103.4 million stolen from 530 addresses. Its account presents a broader incident total than the figure discussed by Decrypt.
Decrypt instead cites onchain investigator Specter’s tracing of more than $86 million in suspected thefts and explicitly says Ledger had not verified that figure. Decrypt also reports that Ledger had not confirmed either the total value lost or the number of affected users, with its investigation continuing.
The accounts therefore should not be treated as interchangeable measurements. An address count is not a count of individual victims, and a suspected-loss estimate is different from a manufacturer-confirmed total. The reporting does not reconcile the differing amounts.
Reseller suspensions put distribution controls in focus
Decrypt reports that Ledger asked distributors and resellers in six Southeast Asian countries and Hong Kong to suspend device sales. Cointelegraph identifies the countries as Indonesia, Singapore, Thailand, the Philippines, Vietnam and Malaysia.
Cointelegraph also describes reports of tampered devices appearing in Europe and a sales suspension by retailer MediaMarkt. It contrasts those reports with Ledger’s position that confirmed thefts were confined to Asia, keeping reported device discoveries separate from confirmed losses.
For holders and project teams, the practical distinction is between trusting wallet technology and establishing the provenance of a particular device. Teams browsing new Ethereum token listings face the same general custody issue when controlling project wallets: exposure of a recovery phrase compromises the control that hardware storage is meant to protect.
Verification and distribution changes are the next milestones
The next substantive development would be Ledger reconciling confirmed losses with the larger totals circulating in reporting. Confirmation of affected users, compromised devices and purchase channels would help distinguish the demonstrated implant mechanism from the full extent of its distribution.
Cointelegraph reports that Ledger’s Atom device includes protections the company says would defeat the implants involved in the Asian thefts. Those statements are manufacturer claims, rather than independent verification established by the reporting.
The same outlet says Trezor is reducing parts of its reseller network because of oversight limitations, while reporting no tampered Trezor devices. That comparison broadens the distribution-control issue without establishing a shared compromise. The unresolved matter is how far the Ledger incident extended, not whether every reseller or hardware-wallet maker experienced the same attack.
Market snapshot
| Asset | Price | 24h | 7d | Market cap |
|---|---|---|---|---|
| Bitcoin (BTC) | $81,627 | -0.6% | -0.8% | $1.64 trillion |
| Ethereum (ETH) | $2,444 | +1.0% | -1.0% | $298.56 billion |
CoinGecko data as of 2026-10-16 (UTC); DeFi TVL from DefiLlama: Ethereum $50.48 billion.
On Coinvote
- New Ethereum Tokens Listed Today: 2,926 projects tracked, 2 new listings in 7 days, 139 community votes today.
- Best Ethereum Meme Coins Today: 256 projects tracked, 0 new listings in 7 days, 0 community votes today.
FAQ
How did the tampered Ledger wallets expose recovery phrases?
Decrypt reports that Ledger’s Donjon team discovered an implant that used LTE to transmit the wallet’s 24-word recovery phrase after capturing it on the display during initialization. Obtaining that phrase can allow an attacker to restore and control the wallet.
How much Bitcoin did the task-scam operator lose?
Decrypt reports more than 60 BTC, while Cointelegraph describes 60 Bitcoin. Both outlets put the reported value at about $4.8 million and attribute the underlying findings to Chainalysis.
Has Ledger confirmed the total losses from the incident?
Decrypt reports that Ledger had not confirmed the overall value lost or the number of affected users. Cointelegraph cites more than $103.4 million across 530 addresses, while Decrypt discusses more than $86 million in suspected thefts that Ledger had not verified.
Sources
- Decrypt: Scammer Lost $4.8M in Bitcoin to Tampered Ledger Wallets: Chainalysis (2026-10-16)
- Cointelegraph: Scammer loses $4.8M stored on tampered Ledgers: Asia Express (2026-10-15)
- CoinGecko (market data), DefiLlama (TVL), Coinvote listing and vote data
Written by the Coinvote news desk from reporting by Decrypt and Cointelegraph. Not financial advice.
