Even Scammers Get Robbed: $4.8M Ledger Wallet Drain

When the Thief Becomes the Victim

In a strange turn of events in the crypto world, a scammer who stole millions from unsuspecting workers just had all their stolen loot taken away by another hacker.

The scammer lost roughly $4.8 million that was stored across three hardware wallet addresses. This unexpected twist came to light during an investigation into a much larger crypto theft totaling over $100 million.

It turns out that even cybercriminals are not immune to security vulnerabilities when handling stolen assets.

How the Original Task Scam Worked

Before the money vanished, it was collected through a classic trick known as a task scam. This type of fraud promises easy daily cash for simple online work.

According to blockchain analytics firm Chainalysis, victims were hired to create fake sales and reviews for real products to boost online ratings.

The scheme followed a very specific playbook to trick workers out of their money:

• Workers completed simple online tasks and initially saw their account balances grow.
• Suddenly, their account balances would turn negative without clear reason.
• The operator told workers to deposit their own crypto to unlock their earnings and continue working.
• Victims kept sending money in hopes of getting paid, fueling the scammer's profits.

On September 22, the scam operator moved these ill-gotten gains into three separate Ledger hardware wallet addresses, where the money sat untouched for a few weeks.

The Twist: $4.8 Million Swept Away

The story took a wild turn on October 9. In single, swift transactions, all three of the scammer's addresses were completely emptied.

The entire $4.8 million stash was transferred into a single wallet address that blockchain tracking tools had already flagged for storing stolen funds.

Chainalysis discovered this transfer while tracing a broader security incident. Their research showed how stolen funds often pass through networks of addresses with prior histories of illicit activity.

The Bigger Picture: A $100 Million Supply Chain Attack

While watching a scammer lose money might sound like poetic justice, the broader situation affected many innocent crypto users.

The drain was linked to compromised hardware wallet devices sold through CryptoBilis, an official reseller operating in Malaysia, Indonesia, and the Philippines.

Starting around October 9, everyday buyers who set up devices bought from this reseller reported that their wallets were suddenly drained of funds.

The scale of the theft grew rapidly as investigators tallied the numbers:

• Initial damage estimates pointed to over $86 million in combined losses.
• Blockchain analysis firm Bitquery later updated the total stolen amount to nearly $102 million.
• The majority of stolen funds were on the TRONTRX+0.27% network, totaling about $79.3 million mostly in USDT stablecoins.
• Bitcoin losses accounted for roughly $16.8 million, or about 203.8 BTCBTC+1.95%, with additional losses on EthereumETH+5.00%.

Actions Taken and Lessons in Security

Following the discovery, Ledger issued an urgent warning to customers who purchased devices through CryptoBilis over the preceding 90 days, advising them not to set up those units.

Users who had already configured their devices were instructed to immediately transfer their crypto assets to a safe destination using a newly generated seed phrase.

Ledger confirmed that confirmed losses remain isolated to Southeast Asia. European spot-checks, including inventory audits in Germany, confirmed that stock in those regions was completely untampered.

Meanwhile, recovery and tracking efforts are actively underway across the industry:

• Stablecoin issuer TetherUSDT-0.30% successfully froze approximately $10 million in stolen USDT.
• Chainalysis is mapping out the attackers' attempts to launder funds using Tornado Cash, Zcash, cross-chain bridges, and token swaps.

This incident serves as a crucial reminder for everyone in crypto: supply chain security is just as important as software security. Always verify hardware sources and store key phrases securely.