Chainalysis has revealed that one of the biggest victims of the Ledger implant thefts was a task scam operator who lost more than 60 Bitcoin (BTC).<\/p>\n
The blockchain analytics firm put that loss at about $4.8 million. It seems the operator moved the scam\u2019s proceeds into three Ledger addresses on September 22, and then emptied all three into the same wallet on October 9.<\/p>\n
A flow chart Chainalysis posted traces the money back to a consolidation wallet, and it labels three of the wallets feeding it as reported scams. Likewise, the largest scam wallet sent it $1.36 million across 106 transfers. Each Ledger address was then drained of about $1.64 million in a single transfer.<\/p>\n
The report said the scam paid people to fake sales and reviews of real products, who then saw a negative balance appear in their accounts. They were told to add their own money before they could be paid.<\/p>\n
One of the biggest victims of the Ledger theft was a scammer themselves. They lost more than 60BTC, about $4.8M. The funds were from a task scam.<\/p>\n
In this task scam, people were paid to fake sales and reviews of real items. Then a \u201cnegative balance\u201d appeared, and they were told to add their own money in order to get paid.<\/p>\n
On Sep 22, the person behind the scam moved the proceeds into three separate Ledger addresses. On Oct 9, thieves emptied all three. One transfer each, into the same wallet. The wallet is reported as stolen funds.<\/p>\n
\u2014 Chainalysis (@chainalysis) October 15, 2026<\/a><\/p>\n\n The US Federal Trade Commission (FTC) described the same pattern in a December 2024 report on task scams. The agency estimated that task scams made up nearly 40% of job scam reports in 2024.<\/p>\n \u201cCryptocurrency is the payment of choice for these scams,\u201d the FTC said. Reported crypto losses to job scams hit $41 million in the first half of 2024, the agency added.<\/p>\n Chainalysis didn\u2019t disclose where the operator bought the Ledger signers, but Ledger has tied every confirmed loss from the incident it disclosed on October 9 to signers sold through CryptoBilis, a Southeast Asian reseller.<\/p>\n On October 10, Ledger found<\/a> an unauthorized hardware implant inside one victim\u2019s signer. Its Donjon security team said the implant reads the screen during setup and captures the 24-word recovery phrase. The implant then sends those words out over LTE through a provisioned eSIM.<\/p>\n On-chain analyst Specter has estimated<\/a> losses from the CryptoBilis drain at more than $86 million, across Bitcoin, Ethereum (ETH) and TRON (TRX).<\/p>\n \u201cWe have not confirmed the total number of affected users or the total value lost,\u201d Ledger said on Tuesday. The company has told anyone who set up a signer bought from CryptoBilis to move their assets to a new signer with a new recovery phrase.<\/p>\n The post Scammer Gets Scammed: Ledger Implant Thieves Steal $4.8M in Bitcoin<\/a> appeared first on CryptoPotato<\/a>.<\/p>","protected":false},"excerpt":{"rendered":" Chainalysis has revealed that one of the biggest victims of the Ledger implant thefts was a task scam operator who lost more than 60 Bitcoin (BTC). The blockchain analytics firm put that loss at about $4.8 million. It seems the operator moved the scam\u2019s proceeds into three Ledger addresses on September 22, and then emptied […]<\/p>\n","protected":false},"author":0,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-240957","post","type-post","status-publish","format-standard","hentry","category-discovery"],"_links":{"self":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts\/240957"}],"collection":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=240957"}],"version-history":[{"count":0,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts\/240957\/revisions"}],"wp:attachment":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=240957"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=240957"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=240957"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Ledger Ties Losses to CryptoBilis<\/h2>\n