Chainalysis said a scammer who earned millions through fake online job offers lost more than $4.9 million in bitcoin after thieves compromised Ledger hardware wallets. The scammer had moved proceeds from the scheme to three Ledger wallet addresses, which attackers emptied, taking 60 BTC. The breach is linked to Ledger devices sold by Southeast Asian reseller CryptoBilis, which contained unauthorized hardware implants able to transmit wallet recovery information over a mobile network. Chainalysis announced the findings on X on Thursday.
Summary written by Upside AI from the original article. Read the source for full details.
Read the original on CoinDesk ↗
Related news
- Scammer loses $4.8M stored on tampered Ledgers: Asia Express
Ledger suspended its reseller network in Southeast Asia after thieves stole more than $103.4 million from 530 addresses through tampered Ledgers inserted into the supply chain. Chainalysis reports that one scammer was also a victim, losing 60 Bitcoin (about $4.8 million) from three newly bought Ledgers containing spyware, with all funds drained into the same wallet. Ledger says all confirmed thefts so far are in Asia, while Trezor will shut some distant resellers from Jan. 1. Elsewhere, South Korea approved blocking 27 websites of unregistered crypto exchanges, Thailand launched Bitcoin and Ether ETF trading, and Australia opened consultation on crypto platform rules.
- Ledger says 'spy' chip inside CryptoBilis Ledger devices transmitted wallet keys over mobile network
Ledger said a covert chip hidden in some hardware wallets sold by reseller CryptoBilis captured users' 24-word recovery phrases from the device screen and sent them to attackers over an LTE mobile network using an eSIM. The implant did not modify the secure element, the operating system, or any transactions and signatures, so Ledger describes it as a physical supply-chain attack rather than a breach of its software or systems. Ledger has confirmed one affected signer with an unauthorized implant and says all confirmed losses in the Oct. 9 incident involved CryptoBilis-sold devices, while it is still examining reports in other devices and locations. Onchain researchers estimated losses of up to $93.2 million across more than 300 wallets, and Tether froze $10 million of USDT tied to the theft. CryptoBilis has stopped selling Ledger signers, and customers who already used one should move assets to a device with a newly generated recovery phrase.
- AI Stocks Plunge, but Jensen Huang Says Nvidia Gets New Chip Orders Almost Daily
Nvidia Corp. (NASDAQ:NVDA) CEO Jensen Huang says customers keep ordering more AI chips than the company can supply, even as a steep tech selloff raises doubts about how buyers will finance the industry's enormous expansion. New orders are arriving almost daily.
- Scammer Lost $4.8M in Bitcoin to Tampered Ledger Wallets: Chainalysis
Chainalysis said one of the biggest victims of the Ledger wallet drain was a scammer who lost more than 60 BTC, about $4.8 million. The funds came from a task scam, and the scammer moved them into three Ledger addresses on September 22, before thieves emptied all three into a single wallet on October 9. Ledger has tied all confirmed losses to devices sold by reseller CryptoBilis, where an implant reads the 24-word recovery phrase during setup and sends it out over LTE. Ledger has asked resellers and distributors in six Southeast Asian countries and Hong Kong to suspend sales, while onchain investigator Specter has traced more than $86 million in suspected thefts that Ledger says it has not verified.
- Trezor Cuts Its Resellers After Ledger Finds Spy Implant in Crypto Wallets
Trezor will end its reseller authorizations on January 1, 2027 and stop shipping new stock to them, calling it a precaution after supply-chain incidents and saying there is no evidence its devices were compromised. The move follows Ledger's Donjon team finding that wallets sold by Southeast Asian reseller CryptoBilis carried a spy implant that captures recovery phrases from the screen and sends them over LTE. Ledger told anyone who bought from CryptoBilis in the past 90 days not to set up their device, while onchain investigator Specter traced more than $86 million in suspected thefts, a figure Ledger says it has not verified. Trezor says CryptoBilis was already off its seller list and that it has received no reports of tampered devices from that retailer. Separately, a ShipMonk data exposure in August affected Trezor customers, with the total put at 80,689 in September, though Trezor says its devices, private keys and wallet backups were not affected.
- Ledger details LTE-enabled spy implants in wallets sold by CryptoBilis
Ledger said LTE-enabled implants in wallets sold by CryptoBilis captured the 24-word recovery phrases shown on device screens during setup and sent them over cellular networks via an eSIM, without compromising the secure chips or altering transactions. The issue came to light after crypto losses involving devices sold through the reseller, which is listed as authorized in Indonesia, Malaysia and the Philippines. Blockchain investigator Specter estimated losses could exceed $86 million, while Yfarmx put them at $103 million, though Ledger has not confirmed a total. CryptoBilis halted sales of all hardware wallet brands in those three countries, Trezor said it received no reports of tampered devices but removed the reseller, and OneKey terminated its authorization and offered free replacements for devices bought from CryptoBilis in 2026. Ledger is also examining reports beyond the reseller, including European cases involving devices bought from MediaMarkt, but has not confirmed a link.
Related markets
Latest news
- Meta Earnings: What To Look For From META
Meta Platforms (NASDAQ:META) will report earnings this Wednesday after the market closes. Last quarter, revenue reached $60.8 billion, up 28% year on year and above analysts' expectations, though revenue guidance for next quarter slightly missed forecasts; daily active users hit 3.6 billion, up 3.4%. The market expects revenue growth of 23.6% this quarter, slowing from 26.2% a year earlier, and analysts have generally reconfirmed their estimates over the past 30 days. Over the last month, consumer internet stocks have gained 1.3% on average, while Meta is down 4.8%.
- An AI bust could come from places investors arent watching , an economist says
Concerns about an AI bubble are growing, and TS Lombard's Dario Perkins warns that investors may be overlooking other risks. Debt among smaller cloud providers, model developers and suppliers could reach $2 trillion by the end of 2027. Perkins does not see this as a systemic risk, but warns that earnings disappointments and canceled orders could ripple through the ecosystem, and that a chip glut could follow over-ordering. Much of the industry's revenue growth still comes from spending within the AI ecosystem rather than from businesses and consumers outside it. He also flags political backlash, noting that ordinary people dislike AI and nearby datacenters, and warns that one high-profile accident could turn AI toxic.
- Yen jumps after JGB auction draws big demand , euro finds relief
The yen rose 0.2% to 158.15 per dollar in Asian trading after a 20-year Japanese government bond auction drew bids of 5.84 times the amount sold, well above the 4.01 times at the previous auction, and the yield fell 6 basis points to 3.71%. A State Street strategist said the record demand suggests sidelined cash is returning and that JGBs are becoming a relative haven from political and fiscal volatility in Europe, particularly France. Anti-government protests in France prompted curfews in several cities, while Italy said it would send 500 troops after two days of unrest, and the euro rallied 0.2% to $1.1234. Elsewhere, bitcoin slipped 0.3% to $81,674.25 and ether edged down 0.2% to $2,393.21.
- Unemployment rate dips to 4 . 7 % - but vacancies hit five - year low
Vacancies fell by 21,000 to 691,000 in the three months to September, the biggest drop since the three months to March and the lowest since July to September 2014 outside the pandemic, while unemployment dipped in the three months to August. Payroll numbers were down 66,000 over the year to September. The ONS said the fall was mainly among smaller firms struggling with higher labour costs, following rises in employer national insurance, the minimum wage and workers' rights. A CBI survey found labour costs and regulations were making it harder to create jobs, and firms urged the Chancellor not to add to their burden in the October 28 Budget. ICAEW's Suren Thiru said the labour market is 'running on idle' and unemployment could climb above 5 per cent, while Shadow Chancellor Andrew Griffith blamed Labour's 'Jobs Tax' and red tape.
- CNBC Daily Open: Tech rebounds in the U.S., but Asia isn’t buying it yet
U.S. tech stocks rebounded as the Nasdaq Composite rose more than 1% on Monday, with Nvidia up 1.4% and Tesla up 3.8%. In Asia, however, tech shares fell on Tuesday, with South Korea's Kospi down over 4% and Japan's Nikkei 225 down 1.6%. Nvidia also unveiled plans to back four German AI startups as part of its nearly $10 billion European investment commitment. Jenny Lee of Granite Asia said Asian companies are reaching IPOs much sooner, often at four to five years old, while Jio Platforms' Indian IPO saw its anchor investor quota oversubscribed more than 30 times, aiming to raise up to 302 billion rupees ($3.2 billion). In Singapore, several agricultural stocks fell after Senior Minister K Shanmugam warned that companies would not escape responsibility for possible roles in the haze, noting seven firms had been questioned by the Singapore Exchange.
- NiSource (NI) Stock Looks Overvalued Against Its Dividend Outlook
NiSource has nearly doubled shareholders' money over the past five years, delivering a 97.6% total return, which raises the question of whether dividends can justify the current share price. The article highlights a new 20-year energy agreement with Microsoft, including customer-funded grid upgrades and long-term electric service for data centers, which may affect future capital needs and cash-flow visibility. Using a Dividend Discount Model with inputs of about $1.35 dividend per share, roughly 9.07% return on equity, a payout ratio slightly above 61%, and implied dividend growth of about 3.5%, the estimated intrinsic value sits meaningfully below the current share price of $41.95. The model still does not bridge that gap, suggesting income investors are paying a premium for a relatively steady payout with modest assumed growth.
Get the briefing on Telegram or Zalo
Join the Upside Telegram channel or Zalo group for the Vietnam stocks and gold briefing at 8:00 and 19:00 (Vietnam time) on trading days, plus a weekly wrap on Saturday morning.