A fraudster who ran a so-called task scam lost roughly $4.8 million in bitcoin after the proceeds were drained by the criminals behind the compromised Ledger hardware devices, according to blockchain analytics firm Chainalysis. The operator lost more than 60 BTC to a separate theft ring, turning one scam into a victim of another.

Chainalysis disclosed the finding in a post on October 15, 2026. The firm linked a wallet address to a task scam in which participants were paid to fabricate sales and reviews of real products. A "negative balance" then appeared in their accounts, and victims were told to add their own money to recover it. They never saw the funds again.

The scheme's operator did not hold the proceeds for long. "On Sep 22, the person behind the scam moved the proceeds into three separate Ledger addresses," Chainalysis said. "On Oct 9, thieves emptied all three. One transfer each, into the same wallet. The wallet is reported as stolen funds."

How did the attackers get inside the devices?

Paris-based Ledger opened an investigation last week after customers in Southeast Asia reported losses following purchases from the Malaysia-based reseller CryptoBilis. Ledger has since described the incident as an organized crime operation in which a group installed hardware implants into devices and returned them to the market. Those implants could read users' seed phrases, letting criminals drain wallets at will.

Ledger called it one of the most "sophisticated attacks" the digital asset industry has experienced. The company has not disclosed total losses. Blockchain investigator Specter has put the figure at $86 million drained — a claim Ledger has neither confirmed nor denied. That gap matters; until the company publishes its own accounting, the true scale remains an estimate from a single outside analyst.

Ledger says it is working with law enforcement to "follow the funds and dismantle the attackers' infrastructure" and has verified that no other vendors were targeted. CryptoBilis has stopped selling Ledger products.

Is hardware wallet security deteriorating?

The Ledger incident is the second major compromise of bitcoin hardware vendors this year. In July, attackers stole close to $120 million from Coldcard users after exploiting a firmware bug that produced faulty seed generation. That flaw allowed hackers to guess seed phrases directly, a failure mode distinct from Ledger's physical implants.

Together the two cases show roughly $206 million in attributed losses across the year's hardware-wallet incidents, if Specter's $86 million estimate holds. The mechanisms differ — one a supply-chain implant, the other a firmware defect — but both defeated the same assumption: that a device's seed phrase never leaves it.

The task-scam operator's loss illustrates a secondary consequence. Stolen funds concentrated in compromised wallets are now themselves targets, and on-chain attribution by firms such as Chainalysis can trace both layers of the chain. For Ledger, the open questions are the confirmed loss total and the scope of law enforcement action; both will shape whether reseller-channel customers retain confidence in sealed-device purchases.