A scammer ran an old trick. Victims got paid to fake reviews and boost sales online. Then came a catch. Victims were told their account showed a negative balance. They had to pay first.
Then they could try to cash out. The scammer moved the stolen money into bitcoin. The funds sat in three Ledger hardware wallets. Then, on Oct. 9, thieves emptied all three.
Chainalysis is a firm that tracks crypto crime. It posted the news on X. "One of the biggest victims of the Ledger theft was a scammer themselves," the post said. It got 302 likes. It got 37 replies within hours.
The loss topped 60 bitcoin. CoinDesk put the dollar value near $4.9M. The theft traces to Ledger devices sold by a reseller called CryptoBilis. Ledger says those devices held a hidden chip. The chip could send wallet recovery words over a phone network.
Other victims lost real savings to this same chip. This one victim lost stolen money instead.
Why did this post spread so fast? People enjoy a clean turn of fate. A thief stole from strangers all year. Then a bigger thief, hiding inside a wallet's own hardware, took it all back.
What does this say about us? Crypto still runs on trust in hardware most people barely understand. A chip meant to guard a password can also steal one. This time, the victim earned little sympathy online. The lesson still lands for everyone else. Hardware you trust can turn on anyone who holds it. That truth stays the same for every owner. Trust in a small metal box only goes so far, this story shows. A password kept on a screen can leak as fast as one kept in a head.