CryptoBilis Ledger Spy-Chip Breach Drains 60 BTC Worth $4.9M From Task Scammer

60 BTC Drained From Three Ledger Wallets

A supply-chain compromise tied to Ledger hardware sold by Southeast Asian reseller CryptoBilis has claimed a strikingly ironic victim. The operator of a fake-job scheme, who accumulated millions of dollars by tricking people with bogus online job offers, lost more than $4.9 million in Bitcoin (BTC) after thieves emptied three wallets loaded onto compromised Ledger devices. Blockchain analytics firm Chainalysis disclosed the case in a post published Thursday on X, stating that the individual had collected the funds through a so-called task scam. That scheme pays recruits small sums at first, typically for posting fake product reviews or boosting online sales figures. The recruits are then told their accounts have fallen into a negative balance and that they must deposit their own money before they can withdraw their supposed earnings. The scam operator moved the proceeds of that operation to three Ledger wallet addresses, and attackers drained all 60 BTC from them, a haul valued above $4.9 million. The compromise stops at the CryptoBilis distribution channel rather than extending to Ledger hardware as a whole: investigators discovered unauthorized implants inside the affected units, capable of transmitting wallet recovery information over a mobile network. Recovery data is what restores a crypto wallet after loss or replacement, and once it leaves the device, control of the stored Bitcoin (BTC) passes to whoever receives it. The implants therefore handed attackers direct access to whatever the affected devices held. What the available disclosures do not yet bound is the size of the exposure: neither the number of implanted units nor the sales window over which CryptoBilis shipped them appears in the material released so far, leaving the at-risk device population an open count.

The task scam behind the loss runs on a simple escalation. Targets answer fake online job offers and are paid for small tasks, most often posting product reviews or inflating sales numbers. Once the pattern of payouts builds trust, the platform claims the account balance has gone negative and demands a deposit before any earnings can be released, a step that converts the fraud from micro-payments into full deposits. Nothing resembling genuine spot trading takes place behind the interface: the earnings exist only inside the scammers' dashboard, and the early payouts are built to trigger the fear of missing out (FOMO) that keeps victims depositing their own funds. The person running this particular operation accumulated millions of dollars that way before the tables turned. Chainalysis's tracing followed the proceeds to three Ledger wallet addresses, which the thieves emptied in full. The hardware layer of the story is the more consequential half. A Ledger device is designed so that the recovery phrase, the word sequence that restores a wallet, never leaves the secure element in normal operation. The implants found in CryptoBilis-sold units broke that assumption by transmitting recovery information over a mobile network, which means the theft required no phishing email, no malware on a connected computer and no mistake by the device owner. Holding the affected hardware was enough to lose everything stored on it. The public record does not identify the thieves, and no figure has been published for how many devices carried the implant or over what period they were sold. The $4.9 million loss is the clearest confirmed damage so far, concentrated in one victim whose own operation was itself criminal.

Affected Device Count Still Undisclosed

Our reading of the on-chain record treats this as a bounded but unfinished case. The drained amount, 60 Bitcoin (BTC) across three addresses, is verifiable directly on-chain, and the tracing ties those addresses to the task-scam operator, so the loss side rests on primary evidence rather than estimates. The unresolved edge sits upstream: without a disclosed device count or a sales window, anyone who bought a Ledger unit through CryptoBilis and still holds funds on it cannot tell from public material whether their recovery data ever left the device. Until a serial-level scope or a checkable remediation step is published, the exposed population stays unbounded, and the three emptied wallets remain the only confirmed endpoints.