In a case of poetic justice, blockchain analysts report that a scammer recently fell victim to the Ledger breach, suffering a loss of approximately $5 million in bitcoin.
According to Chainalysis, a fraudster lost roughly $4.8 million—equivalent to 60 bitcoins—after being targeted in a task scam.
The scheme involved victims being paid to post fake sales and reviews for real products, after which they were instructed to deposit their own funds, only to have the money stolen from them.
One of the biggest victims of the Ledger theft was a scammer themselves. They lost more than 60BTC, about $4.8M. The funds were from a task scam.
In this task scam, people were paid to fake sales and reviews of real items. Then a “negative balance” appeared, and they were told… pic.twitter.com/pGXNJkZJUi
— Chainalysis (@chainalysis) October 15, 2026
However, the mastermind behind the task scam subsequently transferred the stolen funds to Ledger addresses, which were later targeted by other scammers last week.
“On September 22, the scam operator moved the proceeds into three separate Ledger addresses,” Chainalysis reported. “On October 9, thieves drained all three wallets, with a single transfer each into the same destination. The wallet is flagged as holding stolen funds.”
Paris-based Ledger announced last week that it had launched an investigation following reports from customers in Southeast Asia who lost funds after purchasing from Malaysia-based reseller CryptoBilis.
Ledger has since described the operation as a large-scale organized crime scheme, alleging that implants were installed into devices before they were resold, allowing the implants to read users’ seed phrases and enabling criminals to drain wallets.
Labeling the incident among the most sophisticated attacks the digital asset industry has ever seen, Ledger has not yet disclosed the total financial loss, though blockchain investigator Specter estimates $86 million was drained.
According to Chainalysis, the task scam operator was among those victimized by the Ledger breach.
Ledger stated it is collaborating with law enforcement to trace the funds and dismantle the attackers’ infrastructure, adding that no other vendors have been targeted by the scammers.
CryptoBilis has ceased sales of Ledger products, the company confirmed.
Throughout this year, criminals have targeted bitcoin hardware sellers, including a major attack in July targeting popular Coldcard products.
The attackers exploited a firmware bug in Coldcard devices that led to faulty seed generation, enabling hackers to guess victims’ seed phrases and steal nearly $120 million in bitcoin.
