Scammer Loses $4.8M on Tampered Ledger Devices in Chainalysis Report

Irony for a crypto scammer whose funds were drained by spyware

A scammer lost approximately $4.8 million in Bitcoin after storing stolen funds on three tampered Ledger hardware wallets. The wallets had been compromised with spyware designed to record seed phrases, the private recovery codes that control access to cryptocurrency holdings.

Chainalysis, a blockchain monitoring firm, confirmed the incident. The thief drained all three wallets into the same destination address. Ledger has been forced to suspend its reseller network across Southeast Asia after thieves stole more than $103.4 million from 530 addresses through the same supply chain attack.

Key numbers and details

• The scammer lost 60 Bitcoin, worth roughly $4.8 million at the time of the theft.


• Three separate Ledger devices, each containing spyware implants, were involved.


• All stolen funds from the three wallets were moved to a single address.


• The broader Ledger supply chain attack has affected more than 530 addresses and over $103.4 million in total.

What the scammer did before getting scammed

According to Chainalysis, the victim operated a "task scam," a fraud where people are paid to fake sales and reviews of real products. Those victims may in turn have been dishonest participants. Chainalysis noted that once a "negative balance" appeared in the scammer's accounts, they were told to add their own money in order to receive payment. The report described the situation as possibly a "scammer of scammers" being scammed.

Which countries are affected and what Ledger has done

Ledger has asked resellers in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong to remove affected devices from sale. Reports of tampered Ledgers have also emerged in Europe, prompting electronics retailer MediaMarkt to suspend sales. However, Ledger maintains that all confirmed thefts to date are linked to Asia. Trezor has also decided to shut down some of its more distant resellers from January 1 due to concerns about maintaining the same level of vigilance, though there have been no reports of tampered Trezor devices.

Why this matters for hardware wallet users

The incident highlights the ongoing risks of purchasing hardware wallets from unofficial or unverified resellers. Seed phrase spyware can silently record the recovery codes needed to access wallets, allowing thieves to drain funds even when devices appear to function normally. Users who purchased Ledger devices through resellers in affected regions are being urged to check their wallets and consider moving funds to freshly generated addresses on uncompromised hardware.

Source

• Cointelegraph