In a recent turn of events reminiscent of poetic justice, the perpetrators of a significant ledger theft became victims themselves. According to blockchain analysis, a fraudster lost close to $5 million in Bitcoin as a result of the incident.
Chainalysis, in a post published on Thursday, revealed that over 60 Bitcoins, valued at approximately $4.8 million, were stolen from scammers involved in a so-called task scam.
The scam, as detailed by Chainalysis, entailed participants being compensated for fabricated sales and reviews of legitimate products. Victims were instructed to inject their own money into the scheme, which was subsequently misappropriated.
Despite being outsmarted, the masterminds behind the Tusk scam managed to transfer the stolen funds to a ledger address that was later targeted by another fraudster. Chainalysis noted that on September 22, a fraudster divided the proceeds into three separate ledger addresses, which were completely emptied by October 9. Funding transfers from all three addresses funneled into a singular wallet that has been flagged for containing stolen assets.
In response to these incidents, Ledger, the Paris-based digital asset firm, launched an investigation after customer complaints surfaced from Southeast Asia, where individuals reported financial losses tied to a Malaysia-based reseller named Cryptobilis.
Ledger identified this scheme as a large-scale organized crime operation involving the installation of covert implants into devices. These implants have the capability to read users’ seed phrases, thereby compromising the security of their wallets.
Describing the attack as one of the most sophisticated faced by the digital asset industry, Ledger has not yet disclosed the total losses suffered; however, blockchain researcher Spector estimates the loss at $86 million. Alarmingly, among the victims of this fraudulent activity are the task scammers themselves.
Ledger is collaborating with law enforcement agencies to trace the funds and dismantle the infrastructure employed by the attackers to safeguard other vendors from falling prey to similar scams. In the wake of these revelations, CryptoBilis has ceased the sale of Ledger products.
Throughout this year, cybercriminals have increasingly targeted Bitcoin hardware vendors, with a notable breach occurring in July that affected Coldcard users. That attack enabled fraudsters to pilfer nearly $120 million in Bitcoin due to a firmware vulnerability that allowed hackers to guess users’ seed phrases.
As the investigation into these incidents unfolds, the digital asset landscape continues to grapple with evolving threats and the imperative for robust security measures against sophisticated scams.
