Tampered Ledger devices mailed the seed phrase and drained $4.8m in bitcoin

Someone running a task scam moved the proceeds into three separate Ledger addresses on 22 September. On 9 October thieves emptied all three into one wallet, taking more than 60 BTC, about $4.8m, which prices the haul near $80,000 a coin. Each address held around $1.64m. The sum is a reminder of what a hardware wallet is for: the keys sit on the device and nowhere else.

How the devices worked

Ledger's Donjon security team found the mechanism. Devices sold through the Southeast Asian reseller CryptoBilis carry an implant that reads the 24-word recovery phrase shown during setup and sends it out over an LTE connection. The phrase leaves the device before the owner has finished writing it down.

“The implant reads the 24-word recovery phrase shown during setup and sends it out over an LTE connection”

— Ledger Donjon, Finding on the tampered devices

A hardware wallet promises that the seed never leaves the box. A tampered unit breaks that promise at first use, and nothing in how the device behaves afterwards gives it away. The owner sees a normal setup screen, the same twelve or twenty-four words, and a working wallet.

Ledger attributes the confirmed losses to that reseller and has asked for sales suspensions across six Southeast Asian countries and Hong Kong. The investigator known as Specter has traced $86m of suspected thefts following the same pattern, a figure Ledger has not confirmed, and this $4.8m case is 5.6% of it.

Who the victim was

Chainalysis described what the victim did for a living. The task scam recruited people to fabricate sales and reviews, then created an artificial negative balance on their accounts and demanded a deposit of their own money before any earnings could be withdrawn.

Seventeen days passed between the funding and the drain, and the thieves emptied all three addresses on the same day rather than taking the first one as it filled. Holding a copied seed costs nothing, so waiting for the full balance is free.

What settles later

Three things settle later. Whether Ledger publishes a check an owner can run on a device. Whether the $86m figure gets confirmed. And whether any of the six countries acts on the suspension request, while Ledger keeps building lending products on top of the same hardware. Singapore spent this week putting scam detection on the phone, which catches the message but not the device.

Informational material, not investment advice. Ledger attributes the confirmed losses to one reseller, and the wider $86m figure comes from an independent investigator rather than the company.