Awesome, stompix, thanks so much!

That also makes me think it's not a hack, because I would think Coinbase would be the LAST exchange a hacker would use to launder bitcoin, considering the wide array of options they have.

Ok, I'll definitely tell my friend to move all his funds off that Ledger asap.

I could see that a hacker might want to stay invisible and wait until more funds were added to the Ledger, but once their cover was blown with a rogue transaction I'd expect them to just take the money and run.

I'm not a hacker though, so there are surely other angles I'm missing.

Thanks for this reply!

Right, my first guess is that it's an old transaction to an exchange that he forgot about, and it just took a while to post to the network.

This is especially my thought because the "send" amount was much smaller than the "change" amount on the transaction in question:

https://blockchain.info/tx/ed0ef1aba3d1daba9662532aa7f0516c17ef1691debe185e79d1e4e8b627ba1f

If it was a hacker, I would have expected them to just empty the whole wallet.

Another weird thing is that the change address is a bc1 address, which according to my research is a bech32 address, which wouldn't be supported by his Ledger unless it was connected to Electrum, which he says he hasn't used in years.

So weird.

My friend says there's a transaction on his Ledger that he doesn't remember making, and when I follow the trail of transactions it leads to this Bitcoin address that has processed over 12,000 BTC over the last few months:

https://blockchain.info/address/3BtrzTc12u6JPaAuWaAmCJpRhEoDzNhPi6

It's taking in BTC amounts of 50 BTC, and then sending the BTC out in batches of 50 or 100.

I'm guessing that it could be a processing wallet for a major exchange, but I was wondering if you guys had any insights?

Thanks!