Call it poetic justice: one of the biggest victims of last week’s Ledger theft happened to be a scammer themself, according to blockchain analysts, and lost nearly $5 million in bitcoin.
In a post Thursday, Chainalysis wrote that a crook lost 60 bitcoins worth about $4.8 million they’d stolen via a so-called task scam.
According to Chainalysis, the address was linked with a con where people were paid to fake sales and reviews of real items. They were told to add their own money in order to get paid — and then stolen from.
But the mastermind behind the task scam moved the stolen money to Ledger addresses which were then targeted by different scammers last week.
“On Sep 22, the person behind the scam moved the proceeds into three separate Ledger addresses,” Chainalysis said. “On Oct 9, thieves emptied all three. One transfer each, into the same wallet. The wallet is reported as stolen funds.”
Paris-based Ledger last week said it had started an investigation after customers in South East Asia reported they’d lost funds after buying from Malaysia-based reseller, CryptoBilis.
Ledger has since said that the scam was a massive organized crime operation where a group installed implants into devices and put them back on the market. The implants could read users’ seed phrases so criminals could then drain wallets.
Calling it one the most “sophisticated attacks” the digital asset industry has experienced, Ledger is yet to reveal how much money has been lost — but blockchain investigator Specter said $86 million had been drained.
And the task scam conman, according to Chainalysis, was one of the victims.
Ledger has said that it is working with law enforcement to “follow the funds and dismantle the attackers’ infrastructure” and has made sure no other vendors have been targeted by scammers.
CryptoBilis has stopped selling Ledger products, the company said.
Criminals have targeted bitcoin hardware sellers this year, with a huge attack taking place in July on the popular Coldcard products.
Crooks were able to steal close to $120 million in bitcoin from Coldcard users because the devices had a firmware bug which led to faulty seed generation, allowing hackers to guess investor seedphrases.