Ledger Scams: A Fraudster Loses 60 Bitcoins

Hoisted by his own petard. Since October 9, hundreds of holders of compromised Ledgers have seen their cryptocurrencies disappear. Their devices, purchased in Southeast Asia, had been opened and tampered with before sale. Among the victims is a fraudster. He had just parked the loot from a scam involving << paid tasks >> across three freshly created addresses. The result: the thieves took over 60 bitcoins from him, approximately $4.8 million. The same wave also emptied hundreds of wallets linked to the Malaysian reseller CryptoBilis.

Chainalysis published this detail on Thursday afternoon on X. A few hours earlier, Ledger had delivered its first written response to the attack. The manufacturer also ordered its resellers to remove its devices from the shelves.
Key points of this article:

• A fraudster fell victim to a scam involving compromised Ledger wallets, losing over 60 bitcoins in a sophisticated money laundering operation.
• Ledger has removed its products from shelves in Southeast Asia, revealing a highly organized criminal gang that modified authentic devices to steal funds.

Compromised Ledger: A Recap for Those Who Missed the Beginning

On the morning of Friday, October 9, the same actor emptied wallets across six blockchains in less than an hour. The common point among the victims: a Ledger purchased from CryptoBilis, an authorized reseller in Indonesia, Malaysia, and the Philippines. The next day, Ledger confirmed that it had found a hardware implant in the device of one victim.

The component is grafted into the casing. It reads the screen at the moment the wallet displays the 24 words of the recovery phrase, then transmits them via the mobile network using an integrated SIM card. With these 24 words, the thief no longer needs the Ledger. He reconstructs the wallet elsewhere and waits for its owner to deposit their savings.

Chainalysis and Bitquery Trace the Loot from Compromised Ledgers

The scheme of this paid task scam is known to police worldwide. First, the fraudster recruits small hands. The fraudster pays them to simulate purchases and post fake reviews on real products. The initial gains come in, and trust builds. Then a << negative balance >> appears on their account. To unlock their earnings, the recruits must first contribute from their own pockets. You get the picture.

On September 22, the organizer of this scam transferred his gains to three distinct Ledger addresses, to put his loot out of reach. Seventeen days later, on October 9, the thieves emptied all three in a single transaction each. Everything landed in the same wallet, already flagged as a receptacle for stolen funds. << One of the biggest victims of the Ledger theft was itself a fraudster >>, summarizes Chainalysis on X. The timeline speaks for itself. The implant captured the 24 words as soon as the device was set up, then the thief waited for the big day to sweep everything in one go.

Bitquery Traces the Thief of Compromised Ledgers

The analysis firm did not wake up on Thursday. As early as October 9, Chainalysis announced it was investigating << a sophisticated cross-chain money laundering operation >>. The case of the fraudster is the first piece made public. But it is another on-chain analysis company, Bitquery, that delivered the most complete autopsy of the heist. Its analysts started from the ten addresses published on October 9 by researchers tanuki42 and Specter. They then tracked each emptied wallet across six blockchains, with a second independent count to verify the figures.

On Bitcoin, the fraudster's 60 BTC thus joins the 203.8 bitcoins stolen the same morning from 122 wallets, mostly in a single block at 5:54 UTC. Thus, for one man, nearly 30% of the bitcoin stolen that day.

The Bitquery report also addresses a question: there was only one thief, who already held all the keys. On Tron, 25 wallets signed the same authorization for the same address in three seconds. Eight minutes earlier, 30 others had their control switched to an unknown key. Humans do not do this. However, software that possesses all the recovery phrases can. The thief had actually trained for two weeks, conducting small test transfers before striking.

Another lesson: six out of ten victim wallets received their first funds within the 90-day window mentioned by Ledger. But more than eight out of ten had done so only since June. The risk likely dates back a bit further than the official guidance.

The Loot from Compromised Ledgers Passes Through Tornado Cash and Zcash

The "inter-chain laundering" mentioned by Chainalysis is then clearly reflected in Bitquery's data. In just a few hours, the thief dispersed the approximately 79 million dollars of stolen USDT on Tron. First, he transferred 20 million to Ethereum via the USDT0 bridge, then converted it to ether. Next, he exchanged 23.7 million for USDD, a stablecoin that Tether cannot freeze. Finally, he split the remainder among instant exchange services like Relay, Chainflip, or THORChain.

Then comes the washing. From October 9 to 13, about 7,260 ETH entered the Tornado Cash mixer. A good portion of what came out then passed through Zcash before returning in USDC or ETH to new addresses. As of October 15, Bitquery was still able to locate 84 million dollars on the chain. The 203.8 BTC, however, have not moved a single satoshi since October 9.

This isolated case weighs little in the overall tally of compromised Ledgers. Bitquery now counts 102 million dollars siphoned from 324 wallets across six blockchains. This figure, verified as of October 15, has neither been confirmed nor contested by Ledger. Tether has also frozen 10 million USDT linked to the investigation. However, the scammer fits the profile of other victims: holders of significant amounts in Southeast Asia, who had just purchased a hardware wallet to secure their stash.

Ledger Pulls Its Wallets from Shelves and Describes a Gang That Spent Millions

Ledger's version arrived on October 15, just hours before the Op3n keynote where the manufacturer unveiled its Ledger Atom. The text speaks of a "very organized criminal group". For many months, this group purchased authentic devices and opened them to graft in custom components. Their role: to capture the recovery phrase at setup. Then they reintroduced these devices into the circuit through Southeast Asian resellers. The gang had set up "its own seed collector servers, its dumping and laundering infrastructures". And it "spent millions" before striking in a single coordinated operation.

Ledger emphasizes what has not given way. The chip, the operating system, and the servers remained intact. "This was not a systemic attack on the supply chain; it was a localized attack on distribution", the company writes in its post. Its lab, nicknamed the Dungeon, dismantled the implant. Teams then purchased and opened devices in stores, in Germany among others, and inspected samples in warehouses. Everything was clean.

New Rules for Ledger Resellers

The practical consequences of the Ledger incident are immediate. Ledger suspends sales at its authorized resellers in Southeast Asia and Hong Kong. There is a ban on reselling a returned device, even if sealed. From now on, no Ledger product should be left on shelves or in display cases. Stock remains in reserve, and the seller only hands it over to the customer at the time of purchase. Ledger also asks its resellers to report any product deemed unusual by a buyer without delay. Finally, the manufacturer invites << the entire industry to do the same >>. Trezor and OneKey had also announced a reduction in their reseller network last week.

Ledger also promises countermeasures << at the product level >>. The Ledger Atom, presented the same day at 849 euros, already detects the opening of its case and the removal of its screen. However, it will not be released until the summer of 2027. No Nano X, Flex, or Stax currently in circulation will benefit from this. For those, the instruction remains the same as it has been for the past ten days: do not configure a device purchased from CryptoBilis in the last 90 days without having it checked.