Scammer Who Duped Job Seekers Loses $4.9 Million in Bitcoin to Ledger Spy-Chip Exploit
Key Takeaways
- •Chainalysis reported that a scammer operating a fake job scheme lost more than $4.9 million in bitcoin, or 60 BTC, when thieves emptied three Ledger hardware wallets holding the illicit proceeds.
- •The scammer's funds came from a task scam in which victims were initially paid to post fake product reviews or boost online sales, then told to deposit their own money to cover negative account balances before withdrawing supposed earnings.
- •The compromised devices were sold by Southeast Asian reseller CryptoBilis and contained unauthorized hardware implants capable of transmitting wallet recovery information over a mobile network.
- •The implants bypassed the core safeguard of hardware wallets, which are designed to keep private keys offline, by sending recovery data remotely so attackers could access stored bitcoin without physical possession of the devices.
- •The incident highlights a supply-chain route of compromise for hardware wallets, since the malicious implants were embedded in devices distributed through a third-party reseller.
A crypto scammer who made millions tricking people with fake online job offers has fallen victim to another scam, losing bitcoin worth more than $4.9 million through compromised Ledger hardware wallets.
Blockchain analytics firm Chainalysis said Thursday on X that the perpetrator collected the funds through a so-called task scam, in which targets are initially paid to post fake product reviews or boost online sales. Victims are then told their accounts have a negative balance and must deposit their own money before they can withdraw their supposed earnings.
According to Chainalysis, the person behind the operation transferred the proceeds of the illegal activity to three Ledger wallet addresses, which thieves emptied, taking 60 BTC — a haul worth more than $4.9 million.
The analytics firm said the fraudster, who tricked people through fake online jobs, became one of the biggest victims of the compromised hardware wallets.
The theft adds a twist to the Ledger security breach involving devices sold by Southeast Asian reseller CryptoBilis. Investigators discovered unauthorized hardware implants embedded in the devices, capable of transmitting wallet recovery information over a mobile network, giving attackers access to the bitcoin stored on them. In an earlier disclosure, Led said the spy chip inside CryptoBilis-sold devices transmitted wallet keys over a mobile network. The episode highlights a supply-chain route of compromise for hardware wallets, since the implants were embedded in the devices sold through a third-party reseller.
Hardware wallets such as those made by Ledger are designed to keep cryptocurrency private keys offline, while wallet recovery information can be used to restore access to the funds a device protects. The reported implants bypassed that safeguard by transmitting recovery information over a mobile network, meaning attackers could obtain the recovery data without physical access to the devices.
This report was first published by CoinDesk.
