A suspected scammer who lost roughly $4.8 million in a Ledger wallet drain has become the unlikely face of the wider $100 million Ledger theft.
The twist is that the stolen money was itself stolen, turning a scam story into a lesson in custody.
How a Scam’s Proceeds Ended Up Drained
A task scam dangles easy money for simple online jobs, then demands deposits before any payout arrives. The pitch is always the same: do a little work, get paid, and deposit a little more to unlock the cash. Here, the workers were the first victims, and the scheme ran on their willingness to keep paying in.
According to Chainalysis, they were paid to fabricate sales and reviews for real products. Then their balances turned negative, and they were told to deposit their own money to unlock payouts.
The operator moved the proceeds into three separate Ledger addresses on September 22, where the money sat until it was taken.
On October 9, those addresses were emptied in single transfers into one wallet already flagged for holding stolen funds. The scammer’s haul was swept out from under them, and the money ended up in the hands of the very kind of actor the scheme preyed on.
That detail is what makes the story more than a footnote. Chainalysis revealed it while tracing the wider Ledger drain, showing how stolen money often moves through addresses that already show a history of theft.
Who Really Loses When Stolen Money Gets Stolen?
The scammer’s loss is only part of the story. Ledger’s wider drain has affected devices sold through CryptoBilis, a reseller operating in Malaysia, Indonesia and the Philippines.
Ordinary buyers paid the real price. Starting around October 9, users who bought devices from the shop reported drained wallets. Early estimates topped $86 million across Ethereum, TRON and Bitcoin.
Bitquery later put the total near $102 million, with about $79.3 million on TRON, mostly in USDT. Bitcoin accounted for roughly $16.8 million, or 203.8 BTC.
Subscribe to our YouTube channel to watch leaders and journalists provide expert insights.
Ledger warned anyone who bought from CryptoBilis in the prior 90 days not to set up their devices. Buyers who had already set up were told to move funds to a new seed. The lesson for users is that the supply chain matters as much as the code.
Ledger says confirmed losses remain limited to Southeast Asia, and European spot-checks, including those in Germany, found no tampered stock.
Meanwhile, Tether has frozen roughly $10 million in USDT, while Chainalysis maps laundering through Tornado Cash, Zcash, bridges, and stablecoin conversions.
