Scammer Loses $4.8M on Ledger Wallets With a Hidden Implant

A scammer who made money from fake job offers has just walked into a trap of their own. They put 60 Bitcoin (about $4.8 million) on three Ledger wallets and were left with nothing 17 days later. Chainalysis reported it, and Decrypt, CoinDesk and Cointelegraph filled in the details.

What exactly happened?

Chainalysis published the transaction trail. On September 22 the person behind the scheme moved their proceeds to three Ledger addresses. On October 9 thieves emptied each one with a separate transfer into a single shared wallet. About $1.64 million left each address.

The analysts did not say where the scammer bought the devices. Still, the dates and amounts match the story Ledger disclosed this week: wallets sold by the Southeast Asian reseller CryptoBilis carried a hidden implant.

How did the implant work?

First, a reminder of what a hardware wallet does. It keeps private keys offline, and during setup it shows a 24-word seed phrase on its screen. Whoever knows those words controls the coins.

Ledger's Donjon team, by its own account, found this setup inside CryptoBilis devices:

• Capture: during first-time setup the implant read the 24 words straight off the screen.
• The phrase was sent out over an LTE mobile connection.
• The owner noticed nothing, because the wallet worked as usual.
• In this case 17 days passed between the deposit and the theft, so there were no warning signs.

What kind of fraud did the scammer run?

The scheme is called a task scam. People are offered side work: fake sales and reviews of real products. At first they get small payouts to build trust.

Then a "negative balance" shows up on their account. To collect their earnings they have to deposit their own money. The deposit vanishes along with the earnings.

Cointelegraph joked about a "scammer of scammers," and Decrypt wrote about the community's glee. The blockchain makes no distinction. The keys were stolen and the coins moved. There is little sympathy here, but the lesson applies to everyone.

How big is the whole story?

One scammer is only an episode. Cointelegraph reports more than $103.4 million stolen from 530 addresses. On-chain investigator Specter puts it above $86 million, a figure Ledger has not verified. Treat these tallies with care, because the investigation is still open. Cointelegraph calls it the worst hardware wallet scandal since the Coldcard seed phrase debacle in late July.

Ledger says all confirmed losses trace back to CryptoBilis, and it asked resellers in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to halt sales. European retailer MediaMarkt reportedly paused Ledger sales too. Maker Trezor is closing some distant partners from January 1, although no tampered Trezors have been reported.

What should wallet owners do?

Buy the device only from the manufacturer. A cheaper offer in a third-party shop costs you a risk you cannot see with the naked eye.

If a wallet was already bought through a middleman, move the funds to a new one bought directly. Ledger has just shown the $849 Atom, with protection it says would block such implants and detect tampering even when powered off. At Kurslog we suggest looking not at the price of the device but at the chain it travelled to reach you.