It’s almost “karma”: According to blockchain analysts, one of the biggest victims in last week’s Ledger theft was actually a scammer himself, losing nearly $5 million in Bitcoin.
Chainalysis stated on Thursday that a scammer who stole 60 bitcoins, worth approximately $4.8 million, through a so-called "task scam," had those bitcoins subsequently stolen by someone else.
Chainalysis stated that this address is associated with a scam: victims were asked to fabricate sales and reviews for real products and were told they needed to invest their own money first to receive payment, after which their funds were stolen.
However, the mastermind behind this scam transferred the stolen funds to a Ledger address, and those addresses were targeted by different scammers last week.
On September 22, the individuals behind the scam transferred the stolen funds to three separate Ledger addresses," said Chainalysis. "On October 9, the thief emptied all three addresses, sending one transaction from each into the same wallet. This wallet has been reported as containing stolen funds."
Ledger, headquartered in Paris, stated last week that it has launched an investigation following reports from Southeast Asian customers who lost funds after purchasing from CryptoBilis, a dealer in Malaysia.
Ledger later stated that this scam was a large-scale organized crime operation: a group installed malicious components into the devices and then reintroduced them to the market. These components can read users' mnemonic phrases, allowing criminals to subsequently empty the wallets.
Ledger stated that the amount lost in one of the most "complex attacks" ever experienced by the digital assets industry has not been disclosed—but blockchain investigator Specter said that $86 million has been stolen.
According to Chainalysis, the scammer behind this task fraud was also a victim.
Ledger stated that the company is cooperating with law enforcement to "track the funds and dismantle the attackers' infrastructure," and has confirmed that no other vendors have been targeted by the fraudsters.
CryptoBilis said the company has stopped selling Ledger products.
This year, criminals have also targeted Bitcoin hardware wallet sellers; in July, the popular Coldcard product suffered a large-scale attack.
Due to a firmware vulnerability in the device, mnemonic phrases were generated incorrectly, allowing hackers to guess investors' mnemonic phrases and steal nearly $120 million worth of Bitcoin from Coldcard users.