A hacker who ran a so-called task scam has lost roughly 60 Bitcoin—about $4.8 million—to the Ledger hardware-wallet implant theft, making the scam operator one of the incident's biggest individual victims.

According to Chainalysis, the scammer transferred proceeds from the scheme into three Ledger wallets on September 22. On October 9, the attackers moved all of the Bitcoin to a single wallet already known to be used for stolen funds.

While the operator now ranks among the largest losers in the affair, the development does not mean the scheme's original victims have recovered their money.

How task scams hook their marks

The operator is accused of paying individuals to create fictitious sales and reviews, then informing them of a “negative balance” and prompting them to deposit cash in order to collect their payout.

The FTC described a similar scheme in 2024, in which small online tasks generate a few payouts that build trust until participants are asked to put up money of their own. The agency estimated roughly 20,000 reports of task scams in the first half of 2024, with total losses from job scams exceeding $220 million.

According to Ledger's statement, criminals purchased genuine devices, hid malicious components inside them, and returned the tampered hardware to Southeast Asian distribution channels. The implants were able to retrieve 24-word recovery phrases during the setup process, allowing criminals to access the wallets remotely. A 24-word recovery phrase is the master backup of a hardware wallet—anyone who obtains it can restore the wallet on another device and move its funds without ever handling the hardware.

Ledger said its system remained safe and has advised authorized resellers to stop displaying devices publicly and hand them over only at the time of purchase.

Following $102 million across six chains

Ledger has not yet determined an overall loss figure. Bitquery estimates the loss at $102 million across 324 wallets on TRON, Bitcoin, Ethereum, Solana, BNB Chain, and Polygon, up from about $86 million previously, and the tally has already been revised upward once.

Bitquery found the affected devices were obtained via CryptoBilis, a reseller operating in Indonesia, Malaysia, and the Philippines. Its investigation also uncovered coordinated movements of stolen funds, including $10 million in USDT that Tether has since frozen, while other stolen assets were traced through Tornado Cash and THORChain.

What the theft means for self-custody

The Ledger theft adds to growing concerns about crypto security. According to TRM Labs, hackers carried out 207 attacks in the first half of 2026, stealing $972 million. Infrastructure and operational breaches accounted for just 15% of those incidents but 76% of total losses, and the implant attack fits that pattern: it exploited the distribution chain that carried the devices to buyers rather than the wallets' cryptography.

The Ledger theft has not been shown to move global crypto prices. Chainalysis found on-chain economic activity fell just 1.6% during a period when crypto market capitalization dropped around 50%, though those figures predate this attack.

While the theft's broader market effects remain unknown, the industry has already moved to address supply-chain vulnerabilities—the weak points in how devices travel from manufacturer to buyer. As Cryptopolitan revealed, Trezor will cancel authorizations from certain resellers starting January 1, 2027, while OneKey has decided to part ways with CryptoBilis. These steps target identified weaknesses in hardware-wallet distribution, but whether they can rebuild confidence in self-custody remains to be seen.