Blockchain analytics firm Chainalysis reported that a scammer lost over 60 BTC, valued at approximately $4.8 million, due to compromised Ledger hardware wallets. The stolen funds originated from a task-based scam involving fake sales and reviews.
On September 22, the scammer transferred the proceeds into three separate Ledger addresses. By October 9, these addresses were emptied, with funds moved to a single wallet identified as holding stolen assets. Each of the three addresses lost about $1.64 million.
Ledger’s security team, Donjon, identified an implant in devices sold by the Southeast Asian reseller CryptoBilis. This malware captures the 24-word recovery phrase during setup and transmits it via LTE. Ledger confirmed that all verified losses are linked to devices sold through this specific reseller.
While on-chain investigator Specter estimated total thefts at more than $86 million, Ledger has not verified this figure. The company has requested that distributors in Hong Kong and six Southeast Asian countries suspend sales of its devices while the investigation continues.
