Bitcoin Magazine

Poetic Justice: Scammer Lost $5M in Bitcoin After Being Targeted by Ledger Thieves

Call it poetic justice: one of the biggest victims of last week’s Ledger theft happened to be a scammer themself, according to blockchain analysts, and lost nearly $5 million in bitcoin. 

In a post Thursday, Chainalysis wrote that a crook lost 60 bitcoins worth about $4.8 million they’d stolen via a so-called task scam. 

According to Chainalysis, the address was linked with a con where people were paid to fake sales and reviews of real items. They were told to add their own money in order to get paid — and then stolen from. 

One of the biggest victims of the Ledger theft was a scammer themselves. They lost more than 60BTC, about $4.8M. The funds were from a task scam.

In this task scam, people were paid to fake sales and reviews of real items. Then a "negative balance" appeared, and they were told… https://t.co/IJX4tx9ib3 pic.twitter.com/pGXNJkZJUi

— Chainalysis (@chainalysis) October 15, 2026

But the mastermind behind the task scam moved the stolen money to Ledger addresses which were then targeted by different scammers last week.

“On Sep 22, the person behind the scam moved the proceeds into three separate Ledger addresses,” Chainalysis said. “On Oct 9, thieves emptied all three. One transfer each, into the same wallet. The wallet is reported as stolen funds.”

Paris-based Ledger last week said it had started an investigation after customers in South East Asia reported they’d lost funds after buying from Malaysia-based reseller, CryptoBilis. 

Ledger has since said that the scam was a massive organized crime operation where a group installed implants into devices and put them back on the market. The implants could read users’ seed phrases so criminals could then drain wallets. 

Calling it one the most “sophisticated attacks” the digital asset industry has experienced, Ledger is yet to reveal how much money has been lost — but blockchain investigator Specter said $86 million had been drained. 

And the task scam conman, according to Chainalysis, was one of the victims.

Ledger has said that it is working with law enforcement to “follow the funds and dismantle the attackers’ infrastructure” and has made sure no other vendors have been targeted by scammers. 

CryptoBilis has stopped selling Ledger products, the company said. 

Criminals have targeted bitcoin hardware sellers this year, with a huge attack taking place in July on the popular Coldcard products. 

Crooks were able to steal close to $120 million in bitcoin from Coldcard users because the devices had a firmware bug which led to faulty seed generation, allowing hackers to guess investor seedphrases. 

This post Poetic Justice: Scammer Lost $5M in Bitcoin After Being Targeted by Ledger Thieves first appeared on Bitcoin Magazine and is written by Mathew Di Salvo.

Bitcoin Magazine

Ledger Says Organized Crime Group Spent Millions Targeting Hardware Wallet Users

Ledger has issued a statement following reports from customers of loss of funds and tampered devices, calling it one the most “sophisticated attacks” the digital asset industry has experienced. 

The hardware manufacturer said Thursday that a “highly organized criminal group” bought Ledger devices and installed implants that could read users’ seedphrases before then putting them back into the supply chain via resellers. 

Paris-based Ledger last week said it had started an investigation after customers in South East Asia reported they’d lost funds after buying from Malaysia-based reseller, CryptoBilis. 

The company then said it confirmed that one of the impacted users’ devices contained an unauthorized hardware implant. 

It isn’t clear how much money has been lost from the tampered devices but blockchain investigator Specter said $86 million had been drained. Ledger did not respond to Bitcoin Magazine’s written questions. 

“[The criminal group] built their own logistics and technology infrastructure with seeds collector servers, draining and laundering infrastructures. They were patient, they spent millions, and they struck in one coordinated operation, draining wallets,” Ledger said in a Thursday statement. 

“There was no flaw in Ledger’s chip, operating system or servers. Ledger’s systems were not compromised. This was an attack on the distribution channel after the devices left our control.”

The company said that in its “largest investigation to date” it sent employees to other markets — including Europe — to make sure other supply chains hadn’t been targeted. 

It said that screened devices were clean and authorized resellers and distributors in Southeast Asia and Hong Kong have suspended their sales. 

Ledger added that it was working with law enforcement to “follow the funds and dismantle the attackers’ infrastructure.”

It isn’t clear how many customers had been targeted from Ledger’s statement. 

The crypto industry is still reeling after hackers in July were able to steal close to $120 million in bitcoin from Coldcard users.  

There have also been a number of data breaches this year, with scammers targeting Ledger to get customer information via the company’s payment processor Global-e.

This post Ledger Says Organized Crime Group Spent Millions Targeting Hardware Wallet Users first appeared on Bitcoin Magazine and is written by Mathew Di Salvo.

Bitcoin Magazine

Trezor Reduces Number of Resellers Following Ledger Drainage Incident 

Hardware manufacturer Trezor has said it has reduced the number of resellers it works with following supply-chain incidents related to its competitor Ledger. 

The Prague, Czech Republic-based company added in a Tuesday post on X that it was in the process of checking which vendors it works with. 

It added that there were no reports of any issues with Trezor devices. “Let us be very clear: there is not a single piece of evidence that Trezor devices have been compromised,” the company wrote. 

“This is a preventive step, taken out of an abundance of caution.”

Signing device manufacturer Ledger last week said it had started an investigation after customers in South East Asia reported they’d lost funds after buying from Malaysia-based reseller, CryptoBilis. 

Following recent supply-chain incidents, we decided to reduce the number of resellers so we can more effectively check those we work with.

Let us be very clear: there is not a single piece of evidence that Trezor devices have been compromised.

This is a preventive step, taken… https://t.co/pKF4tCHo5c

— Trezor (@Trezor) October 13, 2026

Ledger then said that one of the impacted users’ devices contained an unauthorized hardware implant. 

More reports of what appear to be tampered devices have since surfaced on social media but Ledger said Tuesday that only devices sold through CryptoBilis have been linked to lost funds. 

It added that it had only confirmed an unauthorized hardware implant in one affected user’s device. The implant, according to Ledger, was able to read a seedphrase when it appeared on the device. 

Ledger did not reveal how much money had been lost but blockchain investigator Specter said $86 million had been drained from devices. 

“We have not confirmed the total number of affected users or the total value lost,” Ledger added on X. “Figures circulating online come from third parties and Ledger has not fully verified them.”

Ledger did not respond to Bitcoin Magazine’s questions. 

CryptoBilis has also stopped selling devices, Ledger added, and advised customers who bought from CryptoBilis to not set up their devices and contact the Ledger support team. 

Criminals have been targeting hardware wallets this year. Hackers in July were able to steal close to $120 million in bitcoin from Coldcard users due to a firmware bug in the devices. 

Canadian company Coinkite, which makes the popular products, said that the bug led to faulty seed generation, allowing hackers to guess investor seedphrases. 

In a separate incident, hardware wallet manufacturer Trezor last month reported that close to 81,000 customers had their details leaked after its third-party fulfillment partner had data stolen. 

Scammers earlier this year were able to get hold of customer information via crypto wallet Ledger’s payment processor Global-e to send phishing emails.  

This post Trezor Reduces Number of Resellers Following Ledger Drainage Incident  first appeared on Bitcoin Magazine and is written by Mathew Di Salvo.

Bitcoin Magazine

Ledger Investigates Fund Losses Tied to Southeast Asian Reseller After Implant Found in Device

Ledger has said it is working with authorities after users last week reported losing funds and one received a tampered device. But the company reassured customers that the number of impacted products was “limited.” 

The hardware wallet manufacturer added in an announcement on Sunday that it had reached out to affected customers. 

Paris-based Ledger on Friday said it had started an investigation after customers in South East Asia reported they’d lost funds after buying from a reseller. 

Then, on Saturday, Ledger said it confirmed that one of the impacted users’ devices contained an unauthorized hardware implant. 

Ledger would not confirm the amount of money lost but blockchain investigator Specter said $86 million had been drained from devices. 

“As the investigation continues, we are working with relevant authorities,” Ledger wrote on Sunday. 

It added: “Also, we strongly advise users not to purchase from unauthorized resellers, where the risk of buying suspicious, counterfeit or modified devices is important as nothing operates under ledger security guidelines.

“Security isn’t static and this incident underscores why we continuously review and strengthen our distribution and anti-tamper processes.”

Customers in South East Asia last week reported losing funds after buying from Kuala Lumpur, Malaysia-based vendor CryptoBilis. 

Ledger then advised customers who’d bought from CryptoBilis to not set up their devices. 

CryptoBilis has since stopped selling its hardware wallets, Ledger said on Sunday. 

People on social media posted picture evidence of devices implanted into Ledger products, claiming it could get users’ private keys. It isn’t clear how many of Ledger’s signing devices contained the implant. 

Neither Ledger nor CryptoBilis immediately responded to questions from Bitcoin Magazine. 

Hardware wallet security has been a hot topic ever since hackers in July were able to steal close to $120 million in bitcoin from Coldcard users. 

The products, made by Canadian company Coinkite, contained a firmware bug which led to faulty seed generation, allowing hackers to essentially guess investor seedphrases. 

In a separate incident, hardware wallet manufacturer Trezor last month reported that close to 81,000 customers had their details leaked after its third-party fulfillment partner had data stolen. 

Criminals have been targeting data this year, with scammers getting hold of customer information via crypto wallet Ledger’s payment processor Global-e to send phishing emails. 

This post Ledger Investigates Fund Losses Tied to Southeast Asian Reseller After Implant Found in Device first appeared on Bitcoin Magazine and is written by Mathew Di Salvo.

Bitcoin Magazine

Ledger Warns Buyers Not to Set Up Wallets From Reseller After Users Report Losses

Hardware wallet manufacturer Ledger has said that it is investigating loss of user funds after customers in South East Asia reported issues with devices bought from a reseller. 

The Paris-based company on Friday advised customers who’d bought from vendor CryptoBilis within the last 90 days to not set up their devices. 

Ledger did not reveal how much money users had lost but one blockchain investigator, Specter, wrote on X that he’d traced theft addresses following social media posts and that over $86 million had been lost. 

BREAKING: Ledger reports loss of funds from users in South East Asia who purchased products from the reseller "CryptoBillis".

The situation is ongoing and users are urged to review Ledger's official updates. pic.twitter.com/0GT3cthQtD

— Bitcoin Magazine (@BitcoinMagazine) October 9, 2026

The issue comes following a number of data breaches this year in the crypto world and a huge hack of popular Coldcard hardware wallet devices in July. 

“Ledger is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBilis,” Ledger said via its support X account. 

Ledger added that it had asked CryptoBilis to pause all sales and shipments of Ledger devices.

“If you have set up your Ledger device, consider moving assets to a new Ledger signer (with new seed). We will continue to inform customers of updates as the investigation progresses,” the company said. 

In a statement to Bitcoin Magazine, Ledger said that based on the information to date, the incident is isolated specifically to this reseller in this specific market. 

“No reports were made of products purchased directly from Ledger, and Ledger’s infrastructure, systems and services were not compromised,” the company added. 

CryptoBilis is a Kuala Lumpur, Malaysia-based hardware wallet vendor, according to its website. The company did not immediately respond to questions from Bitcoin Magazine. 

The crypto industry is still reeling after hackers in July were able to steal close to $120 million in bitcoin from Coldcard users. 

The products, made by Canadian company Coinkite, had a firmware bug which led to faulty seed generation, allowing hackers to essentially guess investor seedphrases. 

Galaxy Research said in the months following the attack various attackers were able to exploit the bug independently. 

In a separate incident, hardware wallet manufacturer Trezor last month reported that close to 81,000 customers had their details leaked after its third-party fulfillment partner had data stolen. 

Criminals have been targeting data this year, with scammers getting hold of customer information via crypto wallet Ledger’s payment processor Global-e to send phishing emails. 

This post Ledger Warns Buyers Not to Set Up Wallets From Reseller After Users Report Losses first appeared on Bitcoin Magazine and is written by Mathew Di Salvo.