CoinDesk
A fraudster who collected bitcoin through fake online job offers lost more than $4.9 million after thieves emptied three Ledger wallet addresses, taking 60 BTC. Chainalysis said the victim had used the wallets to store proceeds from a task scam that tricked people into depositing their own money after completing fake work.
The theft was linked to Ledger devices sold by Southeast Asian reseller CryptoBilis. Investigators found unauthorized hardware implants capable of transmitting wallet recovery information over a mobile network, giving attackers access to bitcoin held on affected devices.
Why it matters
The incident adds a supply-chain dimension to hardware-wallet security. The problem was not limited to an online account or trading platform. A physical implant in a device sold through a reseller allegedly exposed the information needed to access funds, showing how custody risk can begin before a wallet reaches its owner.
The victim's own activity also adds an unusual twist. The bitcoin came from a task scam, in which victims were paid for fake reviews or online sales activity and then told to deposit money to clear a supposed negative balance. The fraudster became one of the largest known victims of the compromised devices.
Market impact
The case does not point to a bitcoin network failure or a change in BTC's protocol. It puts the focus on device provenance, reseller controls and the security of wallet recovery information. Buyers of hardware wallets will have to treat the supply chain as part of their custody model, particularly when devices come through unofficial or regional distribution channels.
For the wider market, the incident reinforces the distinction between self-custody and secure self-custody. Hardware wallets can reduce exposure to exchange failures, but compromised devices can create a different attack path with potentially large losses.
Frequently asked questions
-
How much bitcoin did the fraudster lose in the Ledger-related theft?
The thieves took 60 BTC, worth more than $4.9 million at the time described in the report.
-
How did the victim originally obtain the bitcoin?
The bitcoin came from a task scam involving fake online jobs, fake reviews or online sales activity, and demands for deposits to unlock supposed earnings.
-
What was found inside the affected Ledger devices?
Investigators found unauthorized hardware implants capable of transmitting wallet recovery information over a mobile network.
-
Which reseller was linked to the compromised devices?
The devices were sold by CryptoBilis, a Southeast Asian reseller.
-
What broader security issue does the incident highlight?
It highlights supply-chain risk in self-custody. Hardware-wallet security depends on device provenance, reseller controls, and protecting wallet recovery information.
WatcherGuru
CryptoSlate
WuBlockchain
Lookonchain
TheBlock
CoinTelegraph