Author: Shenchao TechFlow
According to the original on-chain investigation post by Chainalysis, one of the most severely affected addresses in the recent security breach targeting hardware wallet provider Ledger was not a compliant crypto investor, but rather an organized telecom fraud ring that had long operated online “fake task” schemes. The group deceived victims into creating fictitious transactions and fake reviews for specific e-commerce products, then tricked them into depositing funds under the false pretense of negative account balances, collectively stealing over 60 bitcoins (equivalent to approximately $4.8 million at the prevailing market price).
Fake trading volume and deposit traps: A $4.8 million black-market funding chain
Chainalysis’s tracking of the fund sources indicates that these涉案 assets originated from a typical order-padding gig-based telecom and internet fraud scheme.
Fraudsters widely post high-paying part-time job ads on social media and instant messaging platforms. In the early stages, they return small commissions to build trust with victims, luring them into continuously funding fake transactions to boost sales and reviews for designated merchants. As the funded amounts accumulate, the fraud platform manipulates settlement data in the background, triggering false alerts of “account violations” or “negative balances,” forcing victims to deposit even larger sums to unfreeze their principal. Through multiple automated settlement channels, the fraudsters rapidly convert the stolen fiat currency into over 60 bitcoins to launder bank transfer records.
September Traffic Diversion and October Sweep: The On-chain Trail of a Hacker Stealing from Another Hacker
After consolidating the funds, the scammers attempt to evade centralized institutions' risk control detection using cold storage devices:
On-chain ledger data clearly records the complete transfer process. On September 22, 2025, the fraud group dispersed the illicit proceeds into three separate Ledger hardware wallet custodial addresses. Due to an unpatched supply chain injection backdoor in the external code libraries relied upon by the hardware wallet’s underlying software, on October 9, an external hacker exploited a permission vulnerability and, using a single automated signature command, instantly emptied all Bitcoin assets from the three dispersed addresses, transferring a total of 60.3 BTC to a hacker master control address widely flagged by security agencies. According to Bitcoin on-chain block explorer transaction records, this transfer was confirmed in just one block, resulting in a one-way plundering of illicit funds.
Cold wallets are not an absolute safe zone, and the legal challenges of tracing illicit funds
This black-hat theft case reveals the real-world challenge of fragmented defense layers in the cryptocurrency security ecosystem.
Hardware devices physically isolate private keys from internet exposure, but if users install tampered client firmware or malicious connection protocols, the protection offered by physical cold isolation will be rendered ineffective. To address supply chain vulnerabilities, users must regularly visit Ledger’s Official Security Notice Center to verify firmware hash signatures. Legally, the fraud syndicate, as the upstream perpetrator, has lost its right to legitimate claims; the bitcoin assets stolen and laundered into mixing pools have now been added to the secondary investigation list by the global judicial cooperation network, with cross-border law enforcement data recognition procedures scheduled to commence on October 28 at Beijing Time.