News analysis ·
Tampered Ledgers drained: tracing a scammer's 60 BTC
Chainalysis traced a task scammer's bitcoin into three tampered Ledger addresses and out to thieves. How the trail is read, and what it cannot show.
One of the largest losses from the tampered Ledger hardware wallets belonged to a scam operator, according to blockchain analytics firm Chainalysis. Decrypt reported the operator lost more than 60 BTC, roughly $4.8 million, while CoinDesk put the figure at more than $4.9 million. This article walks through how the money moved on-chain, how analysts read a trail like this, and where that trail stops being useful.
What the trail shows
Chainalysis posted the transaction path on X on Thursday, October 15, 2026. The coins started as proceeds of a task scam. In that scheme, victims were paid small sums to fake product sales and reviews. Then their accounts showed a negative balance, and they were pushed to deposit their own money before they could withdraw anything.
According to a Chainalysis chart described by Decrypt, the scam money first gathered in a consolidation wallet. That is an address where many smaller payments are pooled into one place. On September 22, the operator split the pool across three separate Ledger addresses. Each was later drained of about $1.64 million.
On October 9, thieves emptied all three. Each address sent a single transfer into the same destination wallet. Reports have since flagged that wallet as a holder of stolen funds. Ledger disclosed the incident the same day. CoinDesk said the thieves took 60 BTC from the operator's wallets.
How the theft worked off-chain
The weak point was not the blockchain. Ledger's Donjon security team found an implant inside devices sold through CryptoBilis, a reseller in Southeast Asia. During setup, the implant reads the 24-word seed phrase shown on screen and sends it out over LTE, a mobile data network. CoinDesk described the implants as unauthorized hardware that let attackers reach the bitcoin stored on affected devices.
A seed phrase is the master backup for a wallet. Anyone who holds it can rebuild the private keys and sign transactions. So once the phrase leaked, the thieves did not need the device at all. Ledger has said every confirmed loss involves devices that came through CryptoBilis. Where the scam operator got the devices is unknown: Chainalysis did not disclose it.
The method: following coins between addresses
Bitcoin transactions are public. Each one spends earlier outputs and creates new ones, so an analyst can follow value from address to address. This trail has a clear shape. Many inflows merge into one consolidation wallet. That wallet fans out to three addresses. Weeks later, the three funnel back into one destination.
Two patterns carry most of the meaning. The first is timing: all three Ledger addresses were drained on the same day, October 9, which may point to one actor working through a list of stolen seeds. The second is convergence: three unrelated-looking addresses paying into one wallet is a hint that one party may control the receiving end. Reports have flagged that wallet as holding stolen funds.
Onchain investigator Specter has tracked more than $86 million in suspected thefts linked to the tampered devices. Ledger says it has not verified that figure.
Limits of this kind of trail
An on-chain trail is strong on where coins went and when. It is weak on who and why. Keep these gaps in mind:
- Labels are judgments. Calling a wallet a scam pool or a thief's wallet relies on the analytics firm's own clustering and outside reports, not on anything written on the chain.
- The chain cannot see the attack. Nothing on-chain shows a seed being read from a screen or sent over LTE. That link comes from Ledger's device investigation, not from the transactions.
- Dollar values can differ between reports. Decrypt cites roughly $4.8 million and CoinDesk more than $4.9 million for the loss, and the sources do not explain the gap.
- Totals are unconfirmed. Specter's figure counts suspected thefts, and Ledger has not confirmed how many users were affected or how much was lost.
None of this makes the trail wrong. It means the transactions answer one question well, the path of the money, and leave the rest to device forensics and investigators.
What to watch next
Ledger's investigation is still running. On Tuesday, the company asked sellers and distributors in Hong Kong and in six Southeast Asian countries to pause sales of its devices. Watch for a confirmed count of affected users and total losses from Ledger, and for whether the destination wallet moves coins onward. Movement into exchanges or mixing services would be the next visible step in the trail, and the point where tagged funds can sometimes be frozen. For readers, the wider lesson is that a hardware wallet is only as safe as its supply chain.
Sources
Drafted by AI from the research and on-chain sources listed, then published automatically once checks confirmed the figures against those sources and found no copied text. Not reviewed by a person. Metrics are explained, never turned into price calls.