Scammer Who Ran Fake Job Scheme Loses $4.9 Million in Bitcoin to Ledger Spy-Chip Hack
Fake Job Scammer Loses $4.9 Million in Bitcoin to Ledger Exploit
A cryptocurrency fraudster who built millions by running fake online job offers has itself become a victim of a hardware wallet hack, losing more than $4.9 million in bitcoin. Blockchain analytics firm Chainalysis confirmed the loss on Oct. 16, 2026.
The attacker gained access to bitcoin stored on Ledger hardware wallets—physical devices used to store cryptocurrency offline—after the fraudster transferred funds from their scam operation into three Ledger wallet addresses. Thieves drained those addresses, stealing 60 bitcoin.
How the Task Scam Worked
According to Chainalysis, the fraudster ran what is known as a "task scam." In these schemes, victims are first paid small amounts to complete simple tasks like posting fake product reviews or boosting online sales. After building trust, scammers then tell victims their accounts have a negative balance and must deposit their own money before being allowed to withdraw their supposed earnings.
The bitcoin collected through this operation was eventually moved into Ledger wallets, where it was later stolen by a separate group of attackers exploiting compromised hardware.
Link to the CryptoBilis Ledger Exploit
The theft is connected to a broader security breach involving Ledger devices sold through CryptoBilis, a Southeast Asian reseller. Investigators discovered that certain wallets sold by this reseller contained unauthorized hardware implants. These tiny chips were capable of transmitting wallet recovery information—also called seed phrases, which are the secret words used to restore access to a cryptocurrency wallet—over a mobile network, giving attackers remote access to funds stored on the devices.
This means anyone who used a Ledger wallet purchased from CryptoBilis could have had their bitcoin drained without ever physically handing over their funds.
Key Details Confirmed
- The fraudster lost 60 bitcoin, worth more than $4.9 million at the time of the theft.
- Chainalysis reported the incident on its X (formerly Twitter) account on Oct. 16, 2026.
- The stolen bitcoin came from three Ledger wallet addresses funded by the scammer's illegal proceeds.
- The exploit involved unauthorized hardware implants in Ledger devices resold by CryptoBilis.
What This Means for Crypto Security
The case highlights a dangerous twist: even individuals involved in illegal activity are not immune to the risks of compromised cryptocurrency hardware. The Ledger spy-chip incident shows that stolen recovery information can be transmitted remotely, meaning physical possession of a wallet is no longer enough to guarantee the safety of stored funds.
Chainalysis also noted that the fraudster became one of the biggest victims of the compromised Ledger devices, underscoring that the scale of the CryptoBilis exploit extended far beyond ordinary everyday users.
What Happens Next
No details were provided about whether the stolen bitcoin has been recovered or whether the attackers behind the Ledger exploit have been identified. Chainalysis continues to track related transactions, but there is no announced timeline for further action.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.