iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A task-scam operator reportedly lost 60 Bitcoin—about $4.8 million at the time—after setting up three newly purchased Ledger hardware wallets that had allegedly been opened and fitted with a hidden recovery-phrase theft device. The incident points to a supply-chain compromise in the reseller channel, not a remote break-in of Ledger’s servers or wallet software.
What happened
Cointelegraph reported on October 15, 2026, that Chainalysis identified a scammer whose Bitcoin was drained from three recently purchased Ledger devices. The thief moved the funds from all three wallets into the same destination wallet. Chainalysis’s account put the loss at 60 BTC, worth approximately $4.8 million when reported.
The same incident reporting said the broader operation had taken more than $103.4 million from 530 addresses. That is an incident estimate reported by Cointelegraph, not a total published in Ledger’s own response.
Chronology
| When | Reported development | Attribution |
|---|---|---|
| October 13, 2026 | Technical reporting described a hardware implant in reseller units that captured recovery phrases during setup. | The Block, citing Ledger Donjon findings |
| October 15, 2026 | The loss of 60 BTC from three newly purchased devices and the wider 530-address operation were reported. | Cointelegraph, citing Chainalysis |
| October 15, 2026 | Ledger published its response, describing an attack on devices after they left Ledger’s control. | Ledger |
How the tampering worked
Genuine wallets were modified after manufacture
Ledger says criminals bought genuine devices, opened them, installed custom-built hidden components designed to capture the recovery phrase during setup, and returned the units to distribution through resellers in Southeast Asia. The company says its chip, operating system, servers and direct sales were not compromised.
#1 Best Overall
- Effortlessly build your crypto portfolio via the all in one Ledger Wallet app: buy, sell, send, receive, swap, stake and more across popular blockchains. 15,000+ coins & tokens in a single dashboard. Keep a close eye on the market. Compare service providers. Track performance. Get timely alerts. Build your portfolio with confidence.
- Enjoy Bluetooth connectivity, iOS access, and hours of battery use with this mobile-first, secure backup signer. Freedom you can depend on.
- Genuine Check: confirm your signer is authentic during setup with the Ledger Wallet app.
- Protect your signer: keep it in mint condition at all times with a bespoke Pod or Case to avoid scratches and everyday wear and tear.
This distinction matters: a hardware wallet can retain authentic firmware and still be unsafe if an attacker adds circuitry before the customer receives it. The reported attack therefore targeted distribution provenance rather than a cryptographic flaw in Ledger’s Secure Element.
The implant captured the phrase at the most sensitive moment
The Block’s account of Ledger Donjon’s technical work said the implant recorded the 24-word recovery phrase as it was created and transmitted it over LTE using a provisioned eSIM. The report said the implant did not alter the Secure Element or Ledger operating system. Once criminals possessed the phrase, they could recreate the wallet elsewhere and transfer its assets; the device itself did not need to be remotely “hacked.”
Rank #2
- More than just crypto: confirm your device is authentic with Genuine Check, manage all your logins with Ledger Security Key, detect common scams with Transaction Check and more.
- Industry-defining security: battle-tested by the Donjon's white hat hackers, protected by the Secure Element, and powered by Ledger OS.
- Connect effortlessly with Ledger Wallet: pair your secure Ledger signer with the all in one Ledger Wallet crypto app to manage thousands of digital assets across multiple devices and accounts with Ledger Sync from a single, secure dashboard.
- Playful, user-friendly design: monitor the market, compare rates and Clear Sign all transactions on the secure 2.8'' anti-glare, scratch-resistant touchscreen.
- This is what security feels like: Ledger touchscreen signers all come with a private, offline, PIN-protected backup, Ledger Recovery Key, to never lose access to your assets.
What Ledger has confirmed—and what remains an estimate
| Claim | Status |
|---|---|
| Three newly purchased devices lost 60 BTC, approximately $4.8 million at the time | Reported by Cointelegraph from Chainalysis |
| More than $103.4 million taken from 530 addresses | Third-party incident figure reported by Cointelegraph; not stated as a total in Ledger’s response |
| Hidden hardware captured a 24-word phrase and used LTE/eSIM transmission | Technical account from The Block citing Ledger Donjon findings |
| Ledger’s chip, operating system and servers were breached | Ledger says they were not |
| Devices were modified after leaving Ledger’s control | Ledger’s stated explanation |
Ledger says it opened samples from stores and warehouses during its investigation and found the examined units clean. It asked authorized resellers and distributors to suspend sales in Southeast Asia and Hong Kong, said it was screening stock, and reported cooperation with law-enforcement agencies and the security community. No exact Ledger model used by the reported scammer has been established.
The victim’s task-scam operation
According to Chainalysis as quoted by Cointelegraph, the reported victim ran a “task scam.” People were paid to fake sales and reviews of legitimate products, then later saw a “negative balance” and were told to add their own money to receive payment. The crypto loss occurred against that broader fraud operation; the hardware-wallet compromise was a separate physical attack on the tools used to hold the proceeds.
Rank #3
- Get more for less - This comprehensive kit empowers you to take control of your digital life with ease. It includes a certified secure Ledger Nano Gen5, protective Magnet Folio, Recovery Key, all in one Ledger Wallet app, and Susan Kare Badge.
- Enjoy industry leading security - protect your private keys far from hackers' reach with the EAL6+ certified Secure Element and Donjon tested Ledger OS, verify transaction details on the 2.8" touchscreen to avoid costly mistakes.
- Back up & restore access to your assets with a simple tap & secret PIN code. If your Ledger signer is ever lost, stolen or damaged, you stay in control with this NFC enabled, certified secure, water resistant, durable plastic Ledger Recovery Key.
- Make informed decisions at a glance - with the intuitive Ledger Wallet crypto app. Compare 50+ service providers to buy, swap, stake & spend at the best rates. Monitor the market to spot opportunities & manage 15,000+ assets across 100+ chains.
- Keep your signer looking new wherever your active life takes you - with the custom designed Magnet Folio that hugs your Ledger Nano Gen5 on all sides with durable yet stylish materials. Conveniently flip open and closed anywhere, any time.
How to buy a Ledger safely
The central purchasing question is not simply whether a Ledger is genuine. It is whether the device has a trustworthy chain of custody from manufacture to your hands.
| Purchase channel | Supply-chain risk | What to verify |
|---|---|---|
| Direct from Ledger | Lowest known distribution uncertainty, though you should still inspect the package and follow current manufacturer checks | Seller identity, intact packaging, and Ledger’s current setup guidance |
| Authorized reseller | Potentially acceptable, but stock handling and returns matter | Authorization, documented sourcing, and a sealed, untampered unit |
| Marketplace seller | Seller identity and storage history may be unclear | Exact seller, return policy, provenance, and manufacturer guidance before funding |
| Unknown or used seller | Highest risk because prior opening or setup may be impossible to rule out | Do not use for significant funds unless the manufacturer provides a safe recovery path |
Checks during setup
- Buy through Ledger or an authorized channel whenever possible.
- Inspect the box, seals, device body, ports and accessories for opening, adhesive, gaps, unusual screws or added components. Packaging inspection is only a warning sign, not proof that a device is safe.
- Initialize the device yourself and generate a new recovery phrase on the device. Never accept a phrase supplied on paper, in an email or by a seller.
- Never type the recovery phrase into a website, phone, computer form or support chat. Legitimate support does not need it.
- Before transferring substantial assets, confirm that the device passes the manufacturer’s current authenticity and firmware checks.
What to do if you bought from a third-party seller
- Stop funding the device. Do not create or import another wallet on a unit whose provenance is uncertain.
- Do not disclose the recovery phrase. Anyone asking for it can take the funds, and a suspicious device should not be “verified” by entering the phrase online.
- Contact Ledger through its official support channel and follow the current instructions for a potentially tampered device. Keep the purchase record, seller details, packaging and photographs for investigators.
- If the wallet has already held assets, move them to a new recovery phrase generated on a replacement device bought through an official or authorized channel, following Ledger’s current migration guidance. Treat the old phrase as exposed once a device is suspected.
- Report suspicious sales to the marketplace, reseller, Ledger and relevant law-enforcement or consumer-protection authorities. Do not return a device containing an active wallet until you have secured the assets and received instructions.
Is buying a hardware wallet still safe?
A hardware wallet remains useful only when both its cryptography and its physical supply chain are trusted. The reported case shows why “the device turns on” and “the firmware is genuine” are not sufficient checks: an added component can steal a phrase during initial setup without changing the operating system or Secure Element. Buying from an official or authorized channel, generating the phrase yourself and keeping it entirely offline are the practical controls available to buyers.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
