One of the biggest victims of last week's Ledger hardware wallet theft turned out to be a scammer themselves, according to blockchain analysts — and the fraudster lost nearly $5 million in bitcoin in the process.

In a post shared on X on Thursday, Chainalysis reported that the criminal lost more than 60 bitcoin, worth approximately $4.8 million — proceeds of a so-called task scam that the fraudster had run against other victims.

According to Chainalysis, the address was linked to a scheme in which people were paid to fake sales and reviews of real items. The targets were told to add their own money in order to get paid — money that was then stolen from them.

One of the biggest victims of the Ledger theft was a scammer themselves. They lost more than 60BTC, about $4.8M. The funds were from a task scam. In this task scam, people were paid to fake sales and reviews of real items. Then a "negative balance" appeared, and they were told…

— Chainalysis (@chainalysis) October 15, 2026

But the mastermind behind the task scam then moved the stolen money into Ledger addresses, which were targeted by a different group of scammers last week.

"On Sep 22, the person behind the scam moved the proceeds into three separate Ledger addresses," Chainalysis said. "On Oct 9, thieves emptied all three. One transfer each, into the same wallet. The wallet is reported as stolen funds."

Paris-based Ledger, one of the industry's best-known hardware wallet makers, said last week that it had opened an investigation after customers in South East Asia reported losing funds. The company said the affected customers had bought their devices through CryptoBilis, a Malaysia-based reseller of Ledger products.

Ledger has since said the scam was a massive organized crime operation in which a group installed implants into devices and put them back on the market. The implants could read users' seed phrases — the strings of words that guard access to a hardware wallet — meaning criminals could then drain the wallets. Because the tampering occurred before the devices ever reached their buyers, the episode underscores the supply chain risks facing hardware wallet makers and the people who rely on them.

Calling it one of the most "sophated attacks" the digital asset industry has experienced, Ledger has yet to reveal how much money was lost in total — but blockchain investigator Specter said $86 million had been drained. The task scam operator, according to Chainalysis, was among the victims.

Ledger has said it is working with law enforcement to "follow the funds and dismantle the attackers' infrastructure" and has made sure no other vendors have been targeted by scammers. CryptoBilis has stopped selling Ledger products, the company said. With the investigation ongoing and a total loss figure still undisclosed, updates from Ledger and law enforcement remain the key details to watch.

Criminals have targeted bitcoin hardware sellers repeatedly this year. In July, a huge attack hit the popular Coldcard products, allowing crooks to steal close to $120 million in bitcoin from users because the devices had a firmware bug that led to faulty seed generation, letting hackers guess investors' seed phrases. Both incidents turned on the same point of failure: the seed phrase, whether exposed through a firmware flaw or tampered hardware.

This article originally appeared on Bitcoin Magazine and was written by Mathew Di Salvo.