Blockchain analytics firm Chainalysis has revealed that one of the biggest victims of the recent drain of tampered Ledger hardware wallets was a scammer who lost more than 60 BTC, worth approximately $4.8 million.

The disclosure has drawn a degree of schadenfreude from observers, after it emerged that the funds stolen in the incident included the proceeds of a fraud operation run by the victim themselves.

Chainalysis laid out the transactions behind the theft, which saw some $4.8 million worth of Bitcoin stolen, in a post on X on Thursday. According to the firm, the stolen Bitcoin originated from a task scam. In this type of scheme, people are paid to fake sales and reviews of real items. At a certain point, a "negative balance" appears in the participant's account, and they are told to add their own money in order to get paid.

One of the biggest victims of the Ledger theft was a scammer themselves. They lost more than 60BTC, about $4.8M. The funds were from a task scam. In this task scam, people were paid to fake sales and reviews of real items. Then a "negative balance" appeared, and they were told… pic.twitter.com/pGXNJkZJUi

— Chainalysis (@chainalysis) October 15, 2026

In effect, the person behind the task scam ended up on the losing side of a larger theft. On September 22, they moved the proceeds into three separate Ledger addresses. Less than three weeks later, on October 9, thieves emptied all three, sending one transfer from each into the same destination wallet, which has been reported as holding stolen funds.

A chart shared by Chainalysis shows the scam proceeds passing through a consolidation wallet before reaching the three Ledger addresses, each of which was drained of approximately $1.64 million.

Ledger disclosed the incident on October 9, the same day the addresses were drained.

Ledger's tampered devices

Ledger's Donjon security team disclosed that it had found an implant in wallets sold through Southeast Asian reseller CryptoBilis. According to the security team, the implant reads the 24-word recovery phrase from the device's screen during setup and sends it out over LTE. That strikes at the core premise of a hardware wallet, which is designed to keep the recovery phrase offline; once the phrase is captured, it alone is enough to recreate the wallet elsewhere and move the funds it secures, regardless of who put the money there.

Ledger has said that all confirmed losses involve devices sold through CryptoBilis. That pattern places the compromise in the reseller channel rather than in Ledger's direct sales, underlining how tampering can enter the distribution chain after devices leave a manufacturer and before they reach buyers.

Chainalysis did not say where the scammer bought the tampered devices.

Onchain investigator Specter has traced more than $86 million in suspected thefts tied to the tampered-device campaign, although Ledger says it has not verified that figure. On Tuesday, Ledger asked resellers and distributors in six Southeast Asian countries and Hong Kong to suspend sales of its devices.

Ledger has not confirmed the total number of affected users or the total value lost, and its investigation remains ongoing — leaving the campaign's full scope, and the gap between third-party estimates and confirmed losses, as open questions for now.