New forensic reporting has identified a distinct victim inside the wider Ledger supply-chain compromise. Chainalysis says an operator associated with fake-job and task scams routed funds into three hardware wallets affected by the malicious Ledger devices, then lost 60 BTC worth more than $4.9 million.
The blockchain shows the movement of bitcoin from the compromised addresses. The description of the victim as a scam operator is Chainalysis attribution, not a fact that can be established from transaction data alone. CoinDesk reported the finding after Chainalysis published its analysis.
One of the biggest victims of the Ledger theft was a scammer themselves. They lost more than 60BTC, about $4.8M. The funds were from a task scam.
In this task scam, people were paid to fake sales and reviews of real items. Then a “negative balance” appeared, and they were told… https://t.co/IJX4tx9ib3 pic.twitter.com/pGXNJkZJUi
— Chainalysis (@chainalysis) October 15, 2026
This is a material update to the previously reported Ledger incident because it separates one 60 BTC loss from the broader aggregate and adds an attribution trail. It does not revise the mechanics of the compromise or prove that every affected wallet belonged to the same type of victim.
The case also illustrates a difficult recovery issue. Stolen funds can pass from an alleged criminal enterprise to a separate attacker, leaving investigators to document both the original source of funds and the later unauthorized transfer. Attribution, seizure authority and victim claims may not align cleanly.
TOKEN RECON ASSESSMENT
Chainalysis has supplied a more specific victim profile, but the security conclusion is unchanged: hardware-wallet trust can fail before a device reaches the user. The next confirmation point is whether law enforcement or Ledger validates the attribution and whether any portion of the 60 BTC reaches an identifiable service that can freeze or assist in recovering funds.
Sources
Chainalysis: Forensic attribution posted on X
CoinDesk: 60 BTC loss inside the Ledger supply-chain exploit
