Spy Chip Hidden in Ledger Wallet Drains 60 BTC Worth $4.9M From Task Scam Operator CryptoBilis
Key Takeaways
- •The CryptoBilis operator reportedly lost approximately 60 BTC, valued at about $4.9 million.
- •A hidden spy chip was found in the Ledger hardware wallet linked to the loss.
- •Ledger said there was no evidence of compromise involving its infrastructure, systems, or official direct-sales channels.
- •The reported tampering points to a potential vulnerability in the distribution stage between manufacturing and delivery.
- •Recovery-phrase theft can enable attackers to reconstruct wallets and move funds without on-device transaction prompts.
Oct. 16, 2026 — An operator of crypto task scams known as CryptoBilis lost approximately 60 BTC, valued at about $4.9 million, after a Ledger hardware wallet was found to contain a hidden spy chip, according to a report published by COINOTAG.
In an update issued at 12:59 UTC the same day, Ledger paired its remediation guidance with a supply-chain clarification. The company said it had found no indication that its infrastructure, systems, or official direct sales channels were compromised — a conclusion that places the tampering in the distribution leg of the supply chain, after devices leave the factory. That framing narrows the review to the leg of the chain outside the company's direct sales channels, where a device passes between the factory and its final buyer.
Hardware wallets such as those made by Ledger, a France-based manufacturer and one of the most widely used brands in the sector, are designed to keep users' private keys offline and to require physical confirmation on the device before transactions are signed. Supply-chain tampering — interference that occurs between a device's manufacture and its delivery — has been a recurring concern in the industry precisely because it attacks the assumption that the device itself is trustworthy. In previously documented cases, attackers installed covert components or altered firmware so that a device secretly recorded its recovery phrase and transmitted it to the attacker, who could then reconstruct the wallet and drain its funds. Because a recovery phrase alone is sufficient to rebuild a wallet on a separate device, that type of exposure sidesteps the on-device confirmation requirement entirely: funds can be moved without the owner's hardware ever displaying a transaction prompt.
The victim in this case was identified as the operator of a task scam, a fraud format that lures participants with promised payouts for completing simple online assignments.
The report was first published by COINOTAG: https://en.coinotag.com/ledger-spy-chip-breach-drains-60-btc-task-scammer
