Scammer Loses $4.8 Million in Bitcoin to Tampered Ledger Devices, Chainalysis Says

One of the largest known victims of a scandal involving manipulated Ledger hardware wallets appears to have been a scammer himself. According to blockchain analysis company Chainalysis, the individual lost more than 60 Bitcoin, worth approximately $4.8 million, after the funds were drained from three newly purchased Ledger devices that had been tampered with.

"One of the biggest victims of the Ledger theft was a scammer themselves. They lost more than 60BTC, about $4.8M. The funds were from a task scam. In this task scam, people were paid to fake sales and reviews of real items. Then a 'negative balance' appeared, and they were told…" Chainalysis said.

Task scams, as described by Chainalysis, lure victims with payments for completing simple tasks such as fake purchases or product reviews. Victims are then told a negative balance has appeared on their account and are pressured to pay in money, either to offset the alleged shortfall or to unlock further payouts. In this case, the Bitcoin accumulated through such a scheme ended up in the hands of the scammer running it, before being stolen again via the compromised Ledger wallets.

Chainalysis found that attackers emptied all three of the victim's wallets and transferred the Bitcoin to a single address.

A wider hardware tampering scandal

The case forms part of a broader scandal involving Ledger devices sold through authorized retailer CryptoBilis. In early October, numerous users from Southeast Asia reported losing their cryptocurrencies after purchasing devices from the retailer. Ledger has since confirmed an unauthorized hardware implant in at least one of the examined wallets. Total damages across the affected devices are estimated at more than $100 million.

According to the facts gathered so far, the manipulated devices contain additional components capable of reading the 24-word recovery phrase during setup. Crucially, the security chip itself remains untouched, meaning Ledger's own Genuine Check verification process does not detect the manipulation.

Suspicious devices bearing similar signs of tampering have also surfaced in Germany. In response, retailer MediaMarktSaturn has removed all Ledger products from sale while the matter is investigated.

For a European audience increasingly reliant on hardware wallets as the standard for secure self-custody, the episode underscores a growing concern: that the supply chain itself, rather than the device's cryptographic core, can become the point of compromise. With losses already estimated above $100 million and affected devices found on both sides of the continent and beyond, buyers are being urged to scrutinise the provenance of their hardware before trusting it with their holdings.