A so-called task-scam hacker has lost about 60 Bitcoins—or around $4.8 million—due to the Ledger hardware-wallet hack.
As per Chainalysis, the scam operator transferred the proceeds from his crime into three Ledger wallets on September 22. The hackers moved all the Bitcoins on October 9 to one wallet already known to be used for stolen funds.
Although the scammer has become one of the biggest victims of the fraud, it does not imply that the original scam victims recovered their money.
How task scams hook their marks
The operator is accused of paying individuals to create fictitious sales and reviews prior to informing them about a “negative balance” and prompting them to deposit cash to collect their payout.
A similar scheme was described by the FTC in 2024, with small online duties accumulating a few payouts that created trust until participants started to be asked for money. The agency estimated the number of reports about task scams to be around 20,000 in the first half of 2024 and total losses from job scams to exceed $220 million.
According to Ledger’s statement, criminals purchased genuine devices, hid the components inside them, and placed the tampered devices back into Southeast Asian distribution channels. The implants were able to retrieve the 24-word recovery phrases during the installation process, which enabled criminals to access the wallets remotely.
Ledger stated that its system remained safe. It has advised authorized resellers to stop displaying the device publicly and give it only at the time of purchase.
Following $102 million across six chains
Ledger has not yet determined an overall loss number. Bitquery estimates the loss to be $102 million from 324 wallets on TRON, Bitcoin, Ethereum, Solana, BNB Chain, and Polygon, up from about $86 million previously.
According to Bitquery, the affected devices were obtained via CryptoBilis, a reseller operating in Indonesia, Malaysia, and the Philippines. Its investigation also uncovered coordinated movements of stolen funds, including $10 million in USDT that Tether has since frozen. Other stolen assets were traced through Tornado Cash and THORChain.
What the theft means for self-custody
The Ledger theft adds to growing concerns about crypto security. According to TRM Labs, hackers carried out 207 attacks in the first half of 2026, stealing $972 million. Although infrastructure and operational breaches made up just 15% of these incidents, they accounted for 76% of the total losses.
Still, the Ledger theft has not been shown to move global crypto prices. Chainalysis found on-chain economic activity fell just 1.6% during a period when crypto market capitalization dropped around 50%. Those figures predate this attack. Although the theft’s global market effects remain unknown, steps have already been taken by the industry to tackle supply chain vulnerabilities.
As Cryptopolitan reveals, Trezor will be canceling authorizations from certain resellers starting on January 1, 2027, while OneKey decided to part ways with CryptoBilis. These steps tackle identified weaknesses in hardware wallet distribution, but it remains to be seen whether they will be able to rebuild confidence in self-custody.
If you're reading this, you’re already ahead. Stay there with our newsletter.