Crypto Economy says the cause of a $4.8M Ledger wallet theft is unproven, while CoinDesk and Cointribune report it was caused by confirmed spy-chip implants in Ledger devices.
What all sources agree on
- A task-scam operator lost more than 60 BTC after three Ledger wallet addresses were emptied.
- The stolen funds were worth approximately $4.8-4.9 million.
- Chainalysis identified the operator as running a task scam involving fake product reviews/sales and a 'negative balance' scheme requiring victims to deposit money.
- The operator transferred funds into three Ledger wallet addresses on September 22.
- The three addresses were emptied on October 9, with funds sent to a single receiving address.
Where the reports disagree
1Whether Ledger hardware compromise caused the theft
The incident does not establish that Ledger's hardware itself was compromised. A wallet can be exposed through several attack vectors, including stolen recovery phrases, malicious software, compromised devices or deceptive transaction approvals.
The theft was linked to Ledger devices sold by Southeast Asian reseller CryptoBilis that contained unauthorized implants capable of transmitting wallet recovery information over a mobile network.
The case occurs as Ledger confirmed the presence of a spy device in certain wallets, especially among devices distributed in Southeast Asia.
What would settle it: Ledger's own forensic statement on the specific devices/addresses involved in this theft, or a published technical analysis confirming or ruling out hardware implants on these particular wallets.
What to make of it
Treat the loss of over 60 BTC from a task-scam operator's Ledger wallets as established; do not treat the claim that this specific theft was caused by hardware spy-chip implants as settled, since one outlet explicitly says the attack vector is undetermined while two others report it as linked to confirmed implants.
Treat the loss of over 60 BTC from a task-scam operator's Ledger wallets as established; do not treat the claim that this specific theft was caused by hardware spy-chip implants as settled, since one outlet explicitly says the attack vector is undetermined while two others report it as linked to confirmed implants.