Blockchain analytics firm Chainalysis reported that a scammer lost 60 BTC, valued at approximately $4.8 million, due to a separate theft. The funds originated from a task-based scam involving fake sales and reviews, where victims were coerced into depositing their own money.
The perpetrator moved these illicit proceeds into three Ledger addresses on September 22. On October 9, these addresses were drained by other attackers. The incident is linked to a wider security breach involving compromised hardware wallets sold by the Malaysia-based reseller CryptoBilis.
Ledger stated that attackers installed malicious implants into devices to intercept seed phrases. While the company has not disclosed total losses, investigator Specter estimates that $86 million has been stolen. Ledger is currently collaborating with law enforcement to track the funds.
This event follows another major security incident in July, when attackers stole nearly $120 million in bitcoin from Coldcard users. That breach was attributed to a firmware bug that enabled hackers to guess seed phrases due to faulty seed generation.
