CryptoBilis Ledger Spy-Chip Breach Drains 60 BTC Worth $4.9M From Task Scammer

Update 12:59 UTC: Ledger has added a supply-chain clarification alongside its remediation guidance, stating it has found no indication that its infrastructure, systems or official direct sales channels were compromised, which places the tampering in the distribution leg between the factory and the buyer.

60 BTC Drained From Three Ledger Wallets

A supply-chain compromise tied to Ledger hardware sold by Southeast Asian reseller CryptoBilis has claimed a strikingly ironic victim. The operator of a fake-job scheme, who accumulated millions of dollars by tricking people with bogus online job offers, lost more than $4.9 million in Bitcoin (BTC) after thieves emptied three wallets loaded onto compromised Ledger devices. Blockchain analytics firm Chainalysis disclosed the case in a post published Thursday on X, stating that the individual had collected the funds through a so-called task scam. That scheme pays recruits small sums at first, typically for posting fake product reviews or boosting online sales figures. The recruits are then told their accounts have fallen into a negative balance and that they must deposit their own money before they can withdraw their supposed earnings. The scam operator moved the proceeds of that operation to three Ledger wallet addresses, and attackers drained all 60 BTC from them, a haul valued above $4.9 million. The compromise stops at the CryptoBilis distribution channel rather than extending to Ledger hardware as a whole: investigators discovered unauthorized implants inside the affected units, capable of transmitting wallet recovery information over a mobile network. Recovery data is what restores a crypto wallet after loss or replacement, and once it leaves the device, control of the stored Bitcoin (BTC) passes to whoever receives it. The implants therefore handed attackers direct access to whatever the affected devices held. What the available disclosures do not yet bound is the size of the exposure: neither the number of implanted units nor the sales window over which CryptoBilis shipped them appears in the material released so far, leaving the at-risk device population an open count.

The task scam behind the loss runs on a simple escalation. Targets answer fake online job offers and are paid for small tasks, most often posting product reviews or inflating sales numbers. Once the pattern of payouts builds trust, the platform claims the account balance has gone negative and demands a deposit before any earnings can be released, a step that converts the fraud from micro-payments into full deposits. Nothing resembling genuine spot trading takes place behind the interface: the earnings exist only inside the scammers' dashboard, and the early payouts are built to trigger the fear of missing out (FOMO) that keeps victims depositing their own funds. The person running this particular operation accumulated millions of dollars that way before the tables turned. Chainalysis's tracing followed the proceeds to three Ledger wallet addresses, which the thieves emptied in full. The hardware layer of the story is the more consequential half. A Ledger device is designed so that the recovery phrase, the word sequence that restores a wallet, never leaves the secure element in normal operation. The implants found in CryptoBilis-sold units broke that assumption by transmitting recovery information over a mobile network, which means the theft required no phishing email, no malware on a connected computer and no mistake by the device owner. Holding the affected hardware was enough to lose everything stored on it. The public record does not identify the thieves, and no figure has been published for how many devices carried the implant or over what period they were sold. The $4.9 million loss is the clearest confirmed damage so far, concentrated in one victim whose own operation was itself criminal.

On-chain timing of the drain is now established: the scam operator consolidated his proceeds into three Ledger addresses on September 22, and the balances sat untouched until October 9, when each was emptied in single transfers to a wallet already flagged as holding stolen funds. The 60 Bitcoin (BTC) loss sits inside a much wider breach of CryptoBilis-sold devices, for which Bitquery estimates total damage near $102 million, including roughly $79.3 million in USDT on Tron and about 203.8 BTC, valued near $16.8 million, across Ethereum, Tron and Bitcoin. Ledger has warned buyers who purchased through the reseller within the prior 90 days to set up their devices on a new recovery phrase, and Tether has frozen approximately $10 million in USDT connected to the thefts while Chainalysis tracks laundering through Tornado Cash, Zcash, bridges and stablecoin transfers.

Chainalysis's fuller account of the drain, published October 16, sharpens the irony and trims the figure: the task-scam operator is now valued at roughly $4.8 million in stolen bitcoin, a slight revision from the earlier $4.9 million reading, and the firm notes the loss emerged while it was tracing the wider Ledger theft. The destination of the swept funds carries its own detail: the single wallet that received all three October 9 transfers already showed a history of theft, meaning the scammer's proceeds landed in the hands of another criminal actor and passed through addresses previously flagged for stolen funds. That pattern, according to Chainalysis, illustrates how stolen money routinely cycles through addresses with established theft trails, and it leaves the scam operator, the original thief and the current holder of the 60 BTC all inside the same laundering chain.

A chart published by Chainalysis adds a routing detail to the flow: the scam proceeds passed through a consolidation wallet before reaching the three Ledger addresses, each of which held roughly $1.64 million when it was drained. The firm has not said where the scammer bought the devices. Alongside the tracing work, Ledger's Donjon security team reported that the implant reads the 24-word recovery phrase from the screen during setup and transmits it over LTE, and Ledger has stated that all confirmed losses involve units sold through CryptoBilis. On Tuesday, Ledger asked resellers and distributors in six Southeast Asian countries and Hong Kong to suspend sales of its devices, while onchain investigator Specter has traced more than $86 million in suspected thefts, a figure Ledger says it has not verified as its investigation continues.

Ledger has added a supply-chain clarification alongside its remediation guidance, stating it has found no indication that its infrastructure, systems or official direct sales channels were compromised, which places the tampering in the distribution leg between the factory and the buyer. The company's advice to anyone who purchased a device through CryptoBilis within the prior 90 days splits by state: unopened units should not be initialized at all, while devices already set up and holding assets should have their funds moved to a separate secure wallet. Buyers are otherwise told to purchase only through official or authorized channels, inspect packaging on arrival, and never use a device that arrives pre-configured or supplied with a recovery phrase already written down.

Affected Device Count Still Undisclosed

Our reading of the on-chain record treats this as a bounded but unfinished case. The drained amount, 60 BTC across three addresses, is verifiable directly on-chain, and the tracing ties those addresses to the task-scam operator, so the loss side rests on primary evidence rather than estimates. The unresolved edge sits upstream: without a disclosed device count or a sales window, anyone who bought a Ledger unit through CryptoBilis and still holds funds on it cannot tell from public material whether their recovery data ever left the device. Until a serial-level scope or a checkable remediation step is published, the exposed population stays unbounded, and the three emptied wallets remain the only confirmed endpoints.