Chainalysis says a task-scam operator lost 60 BTC to the tampered Ledger drain
A task-scam operator lost 60 BTC, about $4.8 million, when thieves emptied three tampered Ledger addresses into one wallet, Chainalysis says.
Why it matters
The drain removes crypto from users who bought what they believed were genuine devices through an authorised reseller, which puts the burden on Ledger and its channel partners. The scope is unsettled, with reported totals ranging from $86 million to more than $100 million, and Ledger has not published a final loss figure, while phishing crews are already using the panic to harvest recovery phrases. The task-scam angle matters mainly because it shows investigators tracing victim funds through on-chain records to a criminal operator, not because it changes how the hardware flaw is priced.
Where the sources disagree
Total scale of the tampered Ledger drain
$86 million
Protos, Bitcoin Magazine
more than $100 million
BTC-ECHO
more than $103.4 million from 530 addresses
Cointelegraph
Reported totals differ widely: Protos and Bitcoin Magazine cite $86 million, BTC-ECHO says more than $100 million, and Cointelegraph says more than $103.4 million from 530 addresses.
Whether the tampered hardware caused this specific theft
does not establish that Ledger hardware itself was compromised
Bitcoin Insider
linked to CryptoBilis devices containing unauthorised implants transmitting over a mobile network
CoinDesk, Bitcoin Insider
Ledger confirmed a spy device in certain wallets, especially in Southeast Asia
Bitcoin Insider
Bitcoin Insider reports a dispute: Crypto Economy says the incident does not establish that Ledger hardware was compromised, while CoinDesk ties the devices to implants from CryptoBilis and Cointribune says Ledger confirmed a spy device in some wallets.
Figures that do not reconcile
Found by comparing the numbers in the reports automatically. They are differences, not yet confirmed to be about the same thing.
amount taken
$4,800,000
The Daily Hodl
$1.64 million
CryptoPotato
The Daily Hodl reports $4,800,000, CryptoPotato reports $1.64 million (66% apart).
Key facts
Chainalysis reported that a task-scam operator lost 60 BTC when thieves emptied three Ledger addresses
60 BTCReported by Cointelegraph
Cointelegraph, Decrypt and Bitcoin Magazine put the value of the 60 BTC at about $4.8 million
4,800,000 USDDisputed figureReported by Cointelegraph
CoinDesk and Bitcoin.com News put the loss at more than $4.9 million
4,900,000 USDDisputed figureReported by CoinDesk
The scammer moved proceeds into three separate Ledger addresses on September 22
Reported by Decrypt
Thieves emptied all three addresses on October 9 in one transfer each into the same wallet
Reported by Cointelegraph
The task scam paid people to post fake sales and reviews of real items, then showed a negative balance and required deposits of their own money
Reported by Cointelegraph
CoinDesk said the devices came from Southeast Asian reseller CryptoBilis and contained implants that transmit recovery information over a mobile network
Disputed figureReported by CoinDesk
Ledger introduced the Ledger Atom device on October 15 at $849, taking refundable $100 deposits for a 2027 release
849 USDReported by CryptoSlate
What happened
Blockchain analytics firm Chainalysis said on October 15 that one of the largest victims of the tampered Ledger wallet drain was itself a task-scam operator, which lost 60 BTC across three Ledger addresses. Chainalysis traced how the operator moved scam proceeds into three Ledger addresses on September 22, and how thieves emptied all three on October 9 in one transfer each, into a single wallet that is flagged as holding stolen funds. The task scam worked by paying people to post fake sales and reviews of real products, then showing a negative balance and requiring deposits of their own money before payout. Bitcoin.com News reported the same three addresses were linked to task scammers, and BTC-ECHO described the coins as sitting on three newly bought devices that had been hardware-tampered before reaching the owner. Outlets differ on the dollar figure and on whether the tampered hardware is what caused these particular losses: CoinDesk puts the loss at more than $4.9 million and says the devices came from authorised reseller CryptoBilis, Cointelegraph and Decrypt and Bitcoin Magazine put it at about $4.8 million, and Bitcoin Insider reports that Crypto Economy and Cointribune dispute that the hardware compromise is proven for this theft. Neither Chainalysis nor Ledger has said where the scammer bought the devices. Protos separately reported a phishing campaign using a fake Ledger firmware update, alongside a figure of $86 million for the wider spyware operation against Cointelegraph's $103.4 million across 530 addresses, while BTC-ECHO puts the damage at more than $100 million.
How the story developed
- Update
Chainalysis publishes transaction trace of the task-scam operator's losses
Chainalysis said on X that proceeds moved to three Ledger addresses on September 22 and thieves emptied all three on October 9 into a single wallet flagged as stolen funds.
- Official statement
Ledger introduces the $849 Ledger Atom device
The mobile device with an active protective shield took refundable $100 deposits for a planned 2027 delivery.
- First report
First report by Cointelegraph
Scammer loses $4.8M stored on tampered Ledgers: Asia Express
- Update
Cointelegraph reports Ledger suspended its Southeast Asian reseller network
Cointelegraph said thieves stole more than $103.4 million from 530 addresses via tampered Ledgers inserted into the supply chain.
- Independent corroboration
Independently corroborated by CryptoSlate
Ledger wants customers to trust its new $849 device as criminals compromise existing wallets
- Update
German-language coverage names CryptoBilis as the reseller behind tampered devices
BTC-ECHO reported the devices came from authorised dealer CryptoBilis and that Ledger confirmed an unauthorised hardware implant in one examined wallet.
- Official statement
Official statement from Bitcoin.com News
Ledger Thieves Might Have a New Big Problem—Stealing From Criminals
- Update
SlowMist flags a fake Ledger firmware update phishing campaign
The email urges recipients to connect a hardware wallet to protect against spyware, citing recent incidents in Malaysia, and is not listed on Ledger's own phishing scams page.
How coverage built up
Independent sources over time, counted the way the consensus panel counts them: a republication of a wire story does not move the line.
- 15 Oct 2026, 22:42 UTC: Cointelegraph — 1 independent source, 1 reports
- 16 Oct 2026, 00:00 UTC: CryptoSlate — 2 independent sources, 2 reports
- 16 Oct 2026, 03:11 UTC: Crypto News (CryptoNews.net) — 3 independent sources, 3 reports
- 16 Oct 2026, 07:18 UTC: BTC-ECHO — 4 independent sources, 4 reports
- 16 Oct 2026, 10:24 UTC: CoinDesk — 5 independent sources, 6 reports
- 16 Oct 2026, 12:22 UTC: Decrypt — 6 independent sources, 7 reports
- 16 Oct 2026, 15:50 UTC: Bitcoin.com News, official — 7 independent sources, 8 reports
- 16 Oct 2026, 18:34 UTC: Protos — 8 independent sources, 9 reports
- 16 Oct 2026, 22:12 UTC: Bitcoin Magazine — 9 independent sources, 10 reports
- 18 Oct 2026, 07:04 UTC: The Daily Hodl — 10 independent sources, 12 reports
- 18 Oct 2026, 18:13 UTC: CryptoPotato — 11 independent sources, 13 reports
Affected entities
Also mentioned: Solana, TRON, U.S. Securities and Exchange Commission, Michael Saylor, KuCoin
Original sources
Related events
China's P2P stablecoin wallets grew 43-fold from Q1 2024 to Q2 2026
Chainalysis recorded $104.1 billion across 18.1 million Chinese P2P stablecoin transfers in the year to June 2026, while domestic P2P activity rose to 59.1% of the country's crypto economy.
China's spy ministry calls crypto an espionage accomplice; Singapore's crypto economy grows 55%
Cointelegraph reports Beijing's Ministry of State Security calling cryptocurrencies accomplices in espionage, alongside a 55% rise in Singapore's crypto economy.
MoonPay launches Korean unit with three banks, plans won stablecoin channels
MoonPay launched MoonPay Korea on Sept. 29 with Woori Bank, KB Financial Group and KakaoBank, and plans Korean licenses plus won stablecoin distribution if won stablecoins are issued.
Hana Bank Issues $100M Digital Bond on Euroclear Blockchain With Same-Day Settlement
South Korea's Hana Bank issued a $100 million five-year digital bond through Euroclear's D-FMI platform, completing same-day settlement in a first for the country's foreign-currency bond market.
Binance explores stock access in Hong Kong, South Korea, Taiwan and Brazil
Co-CEO Richard Teng says Binance is exploring stock access in Hong Kong, South Korea, Taiwan and Brazil, on top of tokenized U.S. stocks that passed $1 billion in AUM.