A scammer lost more than 60 BTC, roughly $4.8 million, in the tampered Ledger hardware wallet thefts, according to blockchain analytics firm Chainalysis. The firm disclosed the transactions in a post on October 15, identifying the victim as one of the largest losers in the device compromise disclosed by Ledger on October 9.

Chainalysis said the stolen Bitcoin originated from a task scam. Participants were paid to fake sales and reviews of real products, then a "negative balance" appeared in their accounts and they were told to deposit their own money to unlock payment.

The victim moved the scam proceeds into three separate Ledger addresses on September 22, Chainalysis traced. On October 9, thieves emptied all three addresses, with one transfer from each landing in the same wallet — a wallet already flagged in public reporting as holding stolen funds.

What does the on-chain record show?

A chart published by Chainalysis shows the task-scam proceeds passing through a consolidation wallet before reaching the three Ledger addresses. Each address held and lost approximately $1.64 million when the thieves swept them.

The pattern matters for investigators. Three same-day transfers into a single receiving wallet give law enforcement a consolidation point, the kind of cluster that tracing tools use to attribute subsequent movements. Chainalysis has not said whether it identified the operators behind the draining wallet.

The irony is structural: the victim's own proceeds were illicit, which narrows the routes to recovery. A scammer cannot easily file a claim, work with an exchange's fraud team, or cooperate with police without exposing the underlying task scam.

How were the devices compromised?

Ledger's Donjon security team disclosed that it found a hardware implant in wallets sold through Southeast Asian reseller CryptoBilis. The implant reads the 24-word recovery phrase from the device screen during setup and transmits it over an LTE connection, giving the attacker full access to the wallet.

Ledger has said that all confirmed losses involve devices sold through CryptoBilis. Chainalysis did not say where the scammer in this case purchased the compromised devices, so the linkage to the reseller remains an inference rather than a verified fact for this specific victim.

On-chain investigator Specter has traced more than $86 million in suspected thefts tied to the tampered devices. Ledger says it has not verified that figure, and it has not confirmed the total number of affected users or the total value lost.

What happens next?

On October 14, Ledger asked resellers and distributors in six Southeast Asian countries and in Hong Kong to suspend sales of its devices while the investigation continues. The company has not set a public date for resuming sales through those channels.

For buyers, the operational lesson is narrow but sharp: devices purchased through unofficial resellers carried a physical implant that no software update could fix, and seed phrases displayed during setup were exfiltrated before the owner made a single transaction. Ledger's investigation remains open, and further attributions from tracing firms will likely follow as drained wallets consolidate.