Scammer gets scammed in Ledger spy-chip exploit, loses almost $5 million in bitcoin

Major irony alert as scammer falls victim to Ledger supply chain attackLedger was forced to suspend its reseller network across South East Asia this week, after thieves stole more than $103.4 million from 530 addresses via tampered Ledgers inserted into the supply chain. But in a small measure of poetic justice, one of the “victims” was a scammer themselves according to Chainalysis. The blockchain monitoring firm reports that the scammer lost 60 Bitcoin, worth about $4.8 million, from three newly purchased Ledgers containing spyware that records seed phrases. The Ledger thieves drained all three of their funds into the same wallet. In a further irony, the scammer had operated a “task scam” where people were paid to fake sales and reviews of real items. So depending on how much they knew, their victims in turn may not have been entirely honest either. “Then a ‘negative balance’ appeared, and they were told to add their own money in order to get paid,” Chainalysis reports. So it’s possible that a scammer of scammers has just got scammed. In crypto it’s sometimes turtles all the way down.

French hardware wallet maker Ledger received multiple reports of malicious hardware implants months before its latest security crisis, according to Mark Karpelès, former CEO of the collapsed Bitcoin exchange Mt. Gox. Karpelès told Cointelegraph he was aware of at least two people who contacted Ledger about tampered devices dating back to December 2025. Karpelès said he hasn’t encountered any public warning Ledger issued in response. Joe Grand, a security researcher, told Cointelegraph he alerted Ledger on March 4, 2026, about a malicious implant in a Nano X purchased through online marketplace Lazada Thailand in August 2025. Grand said Ledger acknowledged his findings and said it was investigating internally, but he criticized the company for not proactively warning customers about the threat. Vietnamese crypto educator Tai Zen contacted Ledger about a suspected hardware wallet implant in December 2025, according to Mark Karpelès. Source: Tai ZenLedger’s ongoing security crisis surfaced Oct. 9, when crypto losses were reported involving wallets sold through CryptoBilis, a reseller authorized in Southeast Asia.

The service will initially support bitcoin, ether and the stablecoins USDC, EURC and EURAU, with the bank managing clients’ wallets and private keys.

Layer-1 blockchain network Qubic halted operations Sunday after an attacker reportedly exploited weakly generated wallet seeds to drain approximately $1.4 million from more than 1,400 accounts, according to the project. In a statement on X, Qubic said the network was halted at tick 85,371,949, where it remains paused at the time of writing. Qubic said the vulnerability affected wallet seeds generated using any browser on an iPhone or iPad, Safari on a Mac until Oct. 18, 2026, or the Qubic iOS app before July 2025, leading to 2.94 trillion Qubit (QU) stolen. “87.1% of the drained funds never left the Qubic network and remain frozen in place,” said Qubic. “The remaining 12.9% was sent to MEXC, whose team froze the receiving account within about an hour.” The Qubic theft is the latest in a series of attacks tied to weak wallet seeds. In July, Coldcard disclosed that attackers had stolen funds from wallets whose seeds were weakened by a firmware bug. Similar flaws affected Trust Wallet’s browser extension and the Libbitcoin Explorer tool in 2023.

Recent tax rebates have brought buyers back to the market, but their expiry threatens to undo that progress