A suspected cryptocurrency scammer lost approximately $4.8 million when their hardware wallet was swept as part of a broader $102 million supply chain exploit targeting Ledger devices sold in Southeast Asia.
- Key Takeaways
- A task scam operator lost $4.8 million across three Ledger addresses created on September 22 after the funds were swept on October 9.
- Analytics provider Bitquery estimates total drain losses at $102 million, including $79.3 million on TRON and $16.8 million (203.8 BTC) on Bitcoin.
- The compromised hardware devices were distributed by reseller CryptoBilis across Malaysia, Indonesia, and the Philippines.
- Tether has frozen roughly $10 million in USDT, while Chainalysis traces laundering across Tornado Cash, Zcash, and bridges.
How $4.8 Million in Scam Proceeds Were Drained
The targeted operator ran a task scam that paid victims to fabricate sales and reviews for online products. After generating initial trust, the platform displayed negative balances and required users to deposit their own funds to unlock payouts. Proceeds from these victims were transferred into three separate Ledger addresses on September 22.
On October 9, those exact addresses were emptied in single transactions into a single wallet previously flagged for holding stolen assets. Blockchain analysis firm Chainalysis discovered the loss while mapping the larger exploit, highlighting how illicit funds often funnel into addresses with prior histories of theft.
Compromised Supply Chain Impacts Southeast Asia
The broader vulnerability was linked to devices distributed by CryptoBilis, an official Ledger reseller operating in Malaysia, Indonesia, and the Philippines. Starting around October 9, users who purchased hardware from the shop began reporting drained accounts. While initial estimates placed overall losses at $86 million, updated data from Bitquery put the total near $102 million.
According to Bitquery, the stolen assets comprise roughly $79.3 million on the TRON network—primarily in USDT—alongside $16.8 million in Bitcoin (203.8 BTC) and additional balances on Ethereum. In response to the breach, Ledger warned anyone who purchased from CryptoBilis within the prior 90 days not to set up their devices, instructing existing users to transfer funds to a new seed phrase. European spot-checks, including reviews in Germany, confirmed no tampered inventory outside the region.
To mitigate damages, Tether has frozen approximately $10 million in USDT connected to the addresses. Meanwhile, investigators continue to track fund movements across decentralized privacy tools, cross-chain bridges, and stablecoin transfers challenging traditional rails.
Why It Matters
This incident illustrates that hardware security is only as reliable as the supply chain delivering the physical device. Even cold storage mechanisms cannot protect user funds if physical tampering or compromised provisioning occurs prior to customer setup. Furthermore, Tether's intervention demonstrates the growing operational role stablecoin issuers play in freeze requests during major multi-chain exploits.
