An on-chain detective found that a user who bought the dip in June with 80 BTC now has $1,380,000 in unrealized gains.

On October 9, BlockBeats reported, citing Lookonchain, that a user who bought 80 BTC about four months earlier has had the entire holding stolen after moving it into a Ledger hardware wallet purchased from CryptoBillis.

This case illustrates a common pattern in digital-asset news: a large on-chain position is first noticed through monitoring services, then later reinterpreted as a custody or security incident. Lookonchain-style tracking can highlight when coins move between addresses, but it cannot by itself determine whether a transfer was authorized, compromised, or the result of a supply-chain issue.

From a $5,200,000 purchase to a $1,380,000 paper gain

The user bought the 80 BTC at about $65,000 per BTC, an outlay of about $5,200,000. The position at one point showed an unrealized gain of about $1,380,000.

The $5,200,000 outlay and the $1,380,000 unrealized gain describe a paper position: value that appears on a chart or wallet interface, not necessarily cash already withdrawn. A “bought the dip” narrative often focuses on timing and price recovery, but it can obscure the fact that custody choices matter as much as entry price. In self-custody, private keys and device integrity become the real control layer; in exchange custody, the counterparty becomes the key risk. Here, the user moved BTC into a hardware wallet, a category of device intended to store keys away from internet-connected computers.

A Ledger purchase from CryptoBillis preceded the theft

A week before the report, the user bought a Ledger hardware wallet from CryptoBillis, a third-party retailer, and transferred all 80 BTC into the device. The funds are now stolen.

The phrase “hardware wallet” should not be treated as a guarantee of safety. Such devices are generally designed to keep private keys offline and require user confirmation for transactions, but their security depends on unopened packaging, trusted firmware, proper setup, backup handling, and the integrity of the sales channel. When a device is obtained from a third-party retailer rather than a manufacturer’s official channel, the user may face additional questions about whether the hardware or packaging was altered before delivery. Without forensic confirmation, those questions remain open.

Links to recent CryptoBillis cases remain unconfirmed

The incident is linked to recent theft cases involving multiple CryptoBillis customers. Whether the device was tampered with, the attack method and the attacker’s identity have not been confirmed.

The reference to multiple CryptoBillis customers shows why isolated incidents can attract broad attention: a common supplier can create a hypothesis of a shared vulnerability. At the same time, association is not proof. Attackers may use malware, phishing, compromised backups, address substitution, physical tampering, or other methods. Until the mechanism is confirmed, the safest conclusion is that cause remains unknown and the loss is already real regardless of how the cause is eventually explained.

Risk Warning

This article is only a compilation of publicly available information and does not constitute investment advice. Cryptocurrency assets are highly volatile and may involve significant risks, including price swings, security vulnerabilities, wallet or exchange incidents, and irreversible loss of funds. The examples discussed here do not imply that similar gains are achievable or that past performance predicts future results. Readers should verify facts independently, assess their own risk tolerance, and consult qualified professionals before making any investment or asset-management decisions. Always prioritize secure custody practices and make rational judgments.