The most quoted line of the Ledger investigation didn’t come from Ledger. It came from Chainalysis, on October 15:
“One of the biggest victims of the Ledger theft was a scammer themselves. They lost more than 60 BTC, about $4.8M. The funds were from a task scam.” — Chainalysis
It’s a satisfying twist, and the internet enjoyed it. But the details Chainalysis attached to that line matter more than the irony, because they sit right at the intersection of two crime streams — and they quietly contaminate every clean-sounding loss estimate you’ve read about this incident.
Seventeen days between deposit and drain
Per Chainalysis’s disclosure, the transaction pattern reads like this:
- The money’s origin: a task scam. People were recruited to fake sales and reviews of real products, paid small real amounts at first. Then a “negative balance” appeared in their accounts, and they were told to add their own money to unlock the earnings they thought they had built up. That’s the deposit phase — the phase where the scam actually earns. (We broke down the full mechanics, including the money-mule variant, in Crypto Task Scams Explained.)
- September 22: the operator moved the accumulated proceeds through a consolidation wallet and into three separate Ledger addresses — roughly $1.64M each, per the flow chart Chainalysis shared (via Decrypt).
- October 9: thieves emptied all three addresses — one transfer each, into the same receiving wallet, which Chainalysis notes is already reported as holding stolen funds. The same morning, hundreds of other wallets were swept in a coordinated burst.
Put differently: the scammer did everything a cautious holder is told to do. Moved significant value into hardware wallets, split across three addresses, and then waited. It didn’t matter. If the devices themselves were implanted before they reached the buyer, the seed phrase was likely harvested during setup — 24 words read off the screen and transmitted over a mobile network, per Ledger’s security lab — and no amount of address-splitting protects keys the attacker already has.
One caveat worth keeping precise: Ledger has said all confirmed losses trace to devices sold through Southeast Asian reseller CryptoBilis, but Chainalysis did not say where this operator bought the devices. The channel attribution for this particular victim is inference from the pattern, not a stated fact.
The contaminated loss estimate
Here is the part that outlives the schadenfreude.
The Ledger incident’s total estimated losses run from about $86M (onchain investigator Specter — a figure Ledger explicitly has not verified) to $93M–$102M across roughly 324 wallets and six chains (Bitquery’s tally). Those numbers get repeated as “stolen from users.”
The 60 BTC case proves the pool is not that simple. Some of the “user funds” in those wallets were themselves scam proceeds — money that already belonged to task-scam victims before the Ledger thieves took it from the scammer. Chainalysis made the point directly: the trace doesn’t stop at the victim wallet; it continues upstream to whoever ran the fake-review payout loop.
Three practical consequences fall out of that:
- Recovery math gets murky. If law enforcement claws back funds from the attacker’s collection addresses, some of the recovered value arguably belongs to task-scam victims two hops upstream — people who may never file a claim, because task-scam victims often don’t realize (or won’t admit) they were scammed.
- Screening contamination spreads downstream. Any address that later receives a hop of that 60 BTC inherits a taint flag. As Chainalysis’s thread notes, legitimate users who unknowingly receive a downstream fragment get a hit on screening tools they didn’t earn.
- Headline totals need an asterisk. “Stolen from victims” and “stolen from criminals” are mixed in the same estimate. That doesn’t make the theft smaller — it makes the victimology mixed, which is exactly the kind of detail that gets lost when a number becomes a headline.
Two crime economies, one supply chain
The case is a neat demonstration that the crypto underground isn’t one industry — it’s at least two, and they eat each other.
The task-scam economy runs on social engineering: recruit, pay small, freeze, extract deposits. The supply-chain implant economy runs on hardware trust: buy a legitimate distribution channel, modify genuine devices so they pass authenticity checks, harvest seed phrases at scale, and wait for balances to build before a coordinated sweep.
The scammer’s 60 BTC sat in those three wallets for 17 days. That’s not a smash-and-grab on a hot wallet — it’s patient infrastructure that treats every victim equally, whether the funds are life savings or laundered scam revenue. For anyone keeping score at home: the thieves who built the implant operation out-executed the scammer who ran the task funnel, and both out-executed the people who thought a hardware wallet was the last security decision they had to make.
Hardware wallets remain a good idea. The lesson of this incident — as with the address-poisoning cases we’ve documented from the same investigation — is that the device is one link in a chain that includes every hand it passed through between the factory and your desk. Buy from the manufacturer directly. Verify the reseller is actually the reseller. And treat any device that arrived through an unfamiliar channel as untrusted until proven otherwise.
Frequently Asked Questions
How did a scammer fall victim to a hardware wallet attack?
The same way everyone else did. Chainalysis says the operator moved task-scam proceeds into three Ledger addresses on September 22, 2026. If those devices were bought through the implicated reseller channel, an implant could have captured the 24-word recovery phrase during setup and sent it out over a mobile network — giving the thieves the keys no matter who owned the wallet. Chainalysis did not specify where this operator bought the devices.
Whose money was the 60 BTC, really?
Mostly not the scammer's. Task scams extract deposits from recruited victims — people paid small sums to fake product reviews, then told their account showed a negative balance and pressured to add their own money. The 60 BTC was accumulated proceeds of that scheme. Chainalysis noted the tracing continues upstream of the 'victim' wallet toward whoever ran the fake-review payout loop.
Does this change the total loss estimate for the Ledger incident?
It doesn't change the headline numbers, but it qualifies them. Analyst estimates range from about $86M (Specter, unverified by Ledger) to $93M–$102M (Bitquery, 324 wallets, six chains). Some portion of that total — the 60 BTC is the confirmed example — was scam proceeds rather than innocent savings, so 'stolen from victims' and 'stolen from criminals' are mixed in the same pool.
What is a task scam?
A recruitment fraud that pays victims small real amounts for easy tasks — rating restaurants, liking videos, boosting product sales — then escalates: bigger tasks require crypto deposits on the scam's own platform, withdrawals get frozen over a supposed 'negative balance,' and each unlock demands a larger payment. The FBI's IC3 documented the pattern as 'task scamming' in its 2024 annual report.
Has anyone recovered funds from the Ledger theft?
Only partially and defensively. Tether froze $10M in linked USDT early in the investigation, after which the attacker began swapping into stablecoins Tether cannot freeze. Ledger has not confirmed any total loss figure and says its investigation with law enforcement is ongoing.