Blockchain analytics firm Chainalysis says a crypto "task scam" operator lost more than 60 bitcoin, roughly $4.8 to $4.9 million, when thieves emptied three of the operator's Ledger wallet addresses on 9 October. Chainalysis tied the theft to the wave of drains linked to Ledger devices sold through the Southeast Asian reseller CryptoBilis. It's a rare case of a scammer getting scammed, and it carries two lessons for honest people.

What happened

Chainalysis shared the finding on X on Thursday, 15 October. By its account, the operator moved the scam's proceeds into three Ledger wallet addresses on 22 September. On 9 October, the same day Ledger first disclosed the reseller drains, all three addresses were emptied, with one transfer from each going to the same wallet. Coverage puts the haul at a little over 60 BTC, about $4.8 million to $4.9 million depending on the bitcoin price used.

Where the money came from

This was a task scam, the fake online job that has spread across WhatsApp and Telegram. Victims were "hired" to rate products or boost sales, paid a few small amounts to build trust, then shown a "negative balance" and told to deposit their own money, usually in crypto, to unlock their earnings. They never got it back. The FTC's rule for these is simple: never pay to get paid.

What isn't proven yet

Chainalysis links this theft to the CryptoBilis devices, and the timing lines up. But Ledger hasn't published a forensic report on these specific wallets, and some analysts say the transfers alone don't prove how the keys were taken. Ledger has said its own systems and direct sales weren't compromised and calls it an attack on one distribution channel. It says it is working with law enforcement to trace the funds. We covered the wider case in our Ledger reseller report.

What to do

  • Buy a hardware wallet from the maker's own store or an authorized reseller listed on the maker's website. Not a marketplace, not a stranger.
  • If a device arrives with a recovery phrase already filled in, or asks you to use one from the box, stop. A real wallet makes you create your own.
  • Bought one from a reseller recently? Our Ledger spy implant check walks you through what to look for and how to move your funds safely.
  • If a "job" ever asks you to deposit money to get paid, it's a scam. Run it through our 2-minute scam check, then report it at reportfraud.ftc.gov.

Know someone doing "online tasks" for crypto? Send them this.

Sources: Chainalysis on X, 15 Oct 2026, CoinDesk, Decrypt, Bitcoin.com News, FTC task scam guidance.