A cybercriminal lost more than $4.9 million in Bitcoin (around 60 BTC) after their Ledger hardware wallets were breached by another hacker. A report from blockchain analytics firm Chainalysis revealed that all the funds vanished from three physical wallets used to store illicit proceeds.
What makes this incident stand out is not just the sum, but the origin of the funds: stolen loot from an online job scam that was in turn stolen by another hacker.
The Negative Balance Trap
Before the funds were drained by the hacker, the scammer accumulated dozens of Bitcoin through an online job scam (task scam). The scheme targeted job seekers with the promise of daily commissions. Victims were initially given real payouts after completing simple tasks, such as writing fake product reviews or boosting store sales volume on e-commerce platforms.
The fraud began once victims started trusting the job offer. The scammer then rigged the system, notifying victims that their task account balance had suddenly gone negative. To withdraw the promised fictitious commissions, victims were required to deposit their own funds first to cover the negative balance. Once victims sent their money, the scammer immediately transferred the stolen funds to their own wallet addresses.
How a Cellular Chip Breached Three Wallets
The scammer transferred all the scam proceeds to three Ledger hardware wallet addresses. Storing funds in a cold wallet is a common tactic among criminals to avoid tracking and exchange seizures. However, the three units used turned out to harbor a physical vulnerability.
The incident is directly linked to the security breach of Ledger devices previously sold by authorized reseller CryptoBilis in Southeast Asia. Investigators discovered that the affected devices had been compromised with illicit hardware implants. This malicious implant could steal the wallet’s recovery phrase (seed phrase) and transmit it wirelessly over a cellular network to an external party. With the recovery phrase in hand, another hacker was able to drain all 60 BTC remotely without ever touching the scammer’s physical devices.
The Real Risk of Supply Chain Vulnerabilities
Chainalysis records rank the scammer as one of the biggest victims of the physical Ledger hardware vulnerability exploit. The incident is a striking irony: a criminal who defrauded job seekers only to lose millions of dollars in illicit gains in mere minutes.
For crypto asset owners, the breach involving CryptoBilis units offers a crucial lesson on cold storage security. Threats to crypto wallets do not solely stem from clicking phishing links or online password leaks. When hardware integrity is compromised directly within an authorized distributor’s supply chain, the offline protection offered by physical wallets can be rendered useless.
Reported by CoinDesk.
Previously: Ledger OS Was Never Breached - But CryptoBilis eSIM Implant Steals Recovery Phrases Directly from the Screen
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
