Ledger asks reseller to pause sales after $103m wallet theft

A thief took $103.4m from 530 crypto wallet addresses, most of it on 9 October 2026. Ledger linked reports of losses to customers of CryptoBilis, its authorised reseller in South East Asia, paused the reseller’s sales and confirmed a hardware implant in one victim’s device. Control of the victims’ private keys let the attacker move funds across seven blockchains.

Four days later, on 13 October, the attacker was moving more ether through Tornado Cash, which hides the link between deposits and withdrawals. YFarmX has traced a laundering service taking withdrawals out the other side, selling the ether and moving the proceeds through its own copies of Railgun, software for private cryptocurrency transfers.

The runs have continued since: 390 ETH on 15 October and 150 ETH on 16 October, from the same ether wallet, with 100 ETH deposited by 14:50 UTC and a third 50 ETH sent to the feeder wallet at 15:55 UTC. Withdrawals matching the thief’s pattern were sold for USDT and moved to Tron, where the money passed through NEAR Intents and reached cash-out desks. Wallets tied to the thief still held $53.0m in ether and $17.6m in bitcoin at 15:02 UTC on 16 October.

Where the funds are on 16 October

The largest balances are still ether on Ethereum and bitcoin in the two collecting wallets. The table separates those holdings from the money held by services. It covers the addresses named in this article and five further wallets the trace ties to the thief; the wider trace includes other routes and later recipients.

The Ethereum balances are at block 26,205,866, 15:02:35 UTC on 16 October. The two Bitcoin collectors (first, second) still showed zero spent at 15:02 UTC, with nothing waiting in the mempool. Dollar values use Chainlink’s ETH/USD price of $2,463.18, updated at 14:54:11 UTC, and BTC/USD price of $82,089.01, updated at 14:16:11 UTC; USDT is valued at $1.

NEAR Intents changed the 500,000 USDT order and 300,000 USDT order, together worth $800,000, to failed on the morning of 13 October. At 15:00 UTC on 16 October its order records still described both deposits as unrefunded. That records the orders’ status; confirmation of recovery rests with the service.

Tether had already frozen 10,000,001 USDT, about $10m, in the thief’s wallets on 9 October, and the 20 blacklisted wallets still held it at the 14 October check. The freeze, the remaining wallet balances and the mixer transfers describe different stages of the trace. A deposit into a mixer records movement; its amount can later appear elsewhere along the route.

The thief sent another $1.25m through Tornado Cash

The attacker deposited 500 ETH ($1.25m) into Tornado Cash in four runs on 13 October, following 200 ETH (about $498,520 at the 13 October price) deposited in five batches on 12 October. The Ethereum wallet already identified in the theft funded all four of the 13 October runs. Dollar values in this section use Chainlink’s ETH/USD price of $2,492.60, updated at 17:54:23 UTC on 13 October.

Our 13 October thread described the first three runs, 400 ETH (about $1.0m), and the funding wallet’s 1,292 ETH (about $3.25m) balance after them. The additional 100 ETH ($249,260) deposit at 17:52 UTC takes the day’s total to 500 ETH ($1.25m). The table gives the times deposits reached Tornado Cash; the first three runs were funded earlier, from 06:38, 09:41 and 14:00 UTC.

The afternoon run included a 100 ETH deposit at 14:33 UTC, worth $249,260, followed by six smaller deposits. At 17:32 UTC the same funding wallet sent a further 100.003 ETH, about $249,267, to a fresh address. Twenty minutes later, that address deposited 100 ETH into Tornado Cash.

After those transfers, the funding wallet held 1,192.09 ETH ($2.97m) at 18:04 UTC. That balance was part of the 16,220.58 ETH the 13 October check counted across the addresses listed below. The day’s 500 ETH figure counts deposits into Tornado Cash; subsequent withdrawals require a separate trace.

How we link the deposits and withdrawals

YFarmX’s 13 October investigation links the thief’s new Tornado Cash runs to a laundering service through gas payments, a distinctive withdrawal pattern and matching batches. A Tornado Cash deposit creates a note, a claim to withdraw a fixed amount later. Three observations connect the two sides:

1. The service paid the deposit wallets’ fees. On 12 October, the service and wallets it funded sent ether for transaction fees, known as gas, to all five of the thief’s deposit wallets. One received its gas at 16:58:59 UTC, 19 minutes before the thief sent it 40 ETH (about $100,000). The service already had the deposit address before the stolen ether arrived.
2. The withdrawals followed the same unusual pattern. A brand-new wallet withdrew to itself, without a relayer submitting the withdrawal for it, and borrowed gas in the same block from a gas-lending service, repaying it from the withdrawal. Among the 232 withdrawals from Tornado Cash’s 100 ETH pool in the preceding fortnight, none combined those features.
3. The batches matched in size and timing. Six deposit batches across 12 and 13 October were followed 3 to 61 minutes later by withdrawals with matching note counts: 4, 4, 4, 4, 8 and 6. On 13 October the new route expanded to the 100 ETH pool: a deposit at 10:07:35 UTC was followed about 26 minutes later by a 100 ETH withdrawal with the same pattern, worth about $249,260 at that price. The thief’s older runs had already used that pool.

Together these are strong evidence of a connection. Tornado Cash still conceals which exact deposit note funded a withdrawal. The transfers on either side are public, and the service-funded gas gives a direct connection to the thief’s deposit wallets.

The launderer built its own Railgun copies

The suspected laundering service sold the withdrawn ether and paid the proceeds into privately deployed copies of Railgun’s contracts. The earliest identified copy dates to 27 July 2026, ten weeks before the theft. The three copies in the new route are:

The code also connects the July and October deployments. Their proxy contracts, which direct calls to the underlying software, reproduce byte for byte from Railgun’s public code using solc 0.8.17, the London EVM target and 137 optimiser runs. Railgun’s published configuration uses 200 runs. The modified underlying contracts share a compiler metadata fingerprint, supporting a common private source tree. The deployment transactions’ fee caps also follow Hardhat’s default calculation, the next base fee multiplied by 81/64, with a priority-fee addition in some transactions. These are clues to how the copies were built and deployed.

Copy C shows how a small pool can expose a transfer. The ether from the morning’s eight withdrawals was sold for USDT. Between 08:16 and 08:36 UTC, 202,465.808128 USDT, about $202,466, went into the new copy. At 08:37:35, exactly 202,465.808128 USDT came back out in one payment. With that isolated inflow and outflow, the amount and timing made the movement traceable. The recipient then used Aave and sent wrapped tokens back through copy C, so that payment describes a stage in the route rather than a remaining balance.

The service was operating before this theft. Its two July copies had received about $16.7m by 13 October, counting every pass through them, including funds from other sources. That is gross activity through those contracts; repeated deposits of the same funds contribute to it. The private deployments and their operator are distinct from Railgun’s public deployment.

The money passed through two private pools in 22 minutes

The 100 ETH withdrawal at 10:33 UTC on 13 October, subsequently sold for $249,559.80 in USDT, passed through copies A and B and Aave, a lending protocol, before emerging as ordinary USDT in three fresh wallets by 10:55. Aave’s wrapped USDT token, waEthUSDT, represents a claim on deposited USDT; its token count differs from the underlying USDT amount. USDT is valued at $1 below. Both wrapped-token amounts were worth about $249,500, as the redemption at the end confirms.

The sequence follows the proceeds through token conversions and successive private pools, with small deductions along the way. Each pool paid out the same amount of the same token that had just gone in. Those are the balances at the end of this 22-minute sequence; subsequent transfers continued the route. The published thread sets out the sequence alongside the day’s deposits.

What Ledger told its customers

Ledger’s statement on the incident, posted by its support account at 13:32 UTC on 9 October, gives buyers two instructions. Anyone who bought from the reseller in the last 90 days and has not set the device up should not start. Anyone who has should “consider moving assets to a new Ledger signer (with new seed)”.

The 90 days run back to 11 July 2026. Ledger’s second statement came at 17:09 UTC on 10 October: one impacted user’s device “contained an unauthorized hardware implant”, Ledger is reaching out to impacted users and working with the authorities, information goes to its bounty programme at [email protected], and CryptoBilis “has ceased sales of all hardware wallet inventory until the investigation is concluded”.

The earliest public report we found is a reply to Ledger’s account at 07:47 UTC on 9 October from a user who wrote that their wallet “just got hacked without me signing anything” and that the recovery phrase “was hand written in the card and being kept in a safe since”. The first public question linking a victim to CryptoBilis came at 11:19 UTC.

The on-chain analysts published first. tanuki42 listed eight collecting addresses at 12:00 UTC with a loss of “>$72M+”, and the Security Alliance’s emergency team, SEAL 911, asked victims to contact it at 12:29 UTC. Specter added two Bitcoin addresses and an estimate of “$86M+” at 12:24 UTC, and Hacken counted “~$81M” across eight addresses at 13:45 UTC.

CryptoBilis is on Ledger’s own reseller list

Ledger’s official reseller finder lists CryptoBilis for Malaysia, Indonesia and the Philippines. On the Malaysia entry, as listed on 9 October, it sits second, under the Shopee Mall store that carries Ledger’s name. The site’s own footer calls CryptoBilis “a brand of CB International” and carries the number 201901004478, the form of a Malaysian company registration. By 11 October the finder showed “Cryptobilis - Sales temporarily paused” for Malaysia and Indonesia, and the Philippines entry it carried on 9 October was gone.

CryptoBilis describes itself on its Ledger page as “the authorized reseller of Ledger Products in Malaysia”. Its home page says orders ship from Kuala Lumpur, and a sister site serves the Philippines. It also sells Trezor, SafePal, Tangem, OneKey and other hardware wallets.

That listing is the route Ledger recommends. Its buying guide tells customers that “Ledger maintains a dynamic, official registry of Authorised Resellers”, and its security team’s threat model says buying “directly from Ledger or Authorised Resellers is safer”. The same page adds that Ledger’s checks cannot verify “the device’s physical supply chain history”.

The thief took $103.4m from 530 addresses

Reading every transfer into the ten published collectors and five more we found, four on Tron and one on Bitcoin, the theft comes to about $103.4m taken from 530 addresses on seven blockchains. Three quarters of it was Tether’s USDT on Tron. The count rose three times after 9 October. On 10 October the thief’s approval operator was read in full, and it showed two Tron wallets and one Ethereum wallet that were funded from Bybit in the afternoon of 9 October and emptied within minutes, into two collectors the published lists had never carried. On 11 October a fourth Bitcoin collector came to light: it swept 7.13 BTC from 47 more wallets between 14:31 and 23:43 UTC on 10 October, after Ledger’s statement, 40 of them funded once and dormant since, the oldest since 2018. On 12 October nine more Tron wallets came to light: at 20:49:21 UTC on 9 October each sent all its USDT, 8,806,905 USDT in all, to one fresh address with its own key (update of 12 October below).

Bitcoin and ether are valued at Chainlink’s prices at 15:21 and 15:09 UTC on 9 October, $82,835 and $2,484; TRX, BNB and PEPE at CoinGecko’s prices at 14:38 and 14:40 UTC; USDT and USDC at $1. The EVM rows count 59 distinct addresses, because some victims held the same address on several chains, and one person can hold several addresses.

The main run was on 9 October: every Tron and EVM sweep, and 139 of the 326 Bitcoin sweeps, carrying 205.95 BTC ($17.06m). The other 187 Bitcoin sweeps were small. 137 of them, mostly from wallets dormant for years, began at 14:41:59 UTC on 7 October and carried 7.42 BTC ($614,639); three more landed on the evening of 9 October; and the 47 of 10 October carried 7.13 BTC ($591,600).

The losses are concentrated. The largest single Tron account lost 7,001,000 USDT and the largest Bitcoin wallet lost exactly 80 BTC ($6.63m); the 20 largest Bitcoin wallets account for more than four fifths of the bitcoin taken. The median Tron loss was about 180,000 USDT. Several groups of Tron accounts were created within minutes of each other, 20 of them in 42 minutes on 20 June 2026.

Every drain needed the victim’s own key

Every one of the 530 addresses was emptied by a transaction signed with its owner’s private key, or by a key or wallet that the owner’s key had authorised earlier. That control comes from the recovery phrase, which derives the keys for every chain a wallet holds.

The chains show three methods on Tron. At 04:59:57 UTC, 30 accounts had their owner permissions rewritten to add the thief’s key TEqZsE39… at a weight that lets it sign alone; they were drained between 10:26 and 10:30, more than five hours later. At 05:07:48, 25 accounts that had just signed an unlimited approval were pulled by the operator wallet TAzdU79… in six seconds, moving 28.98m USDT. Another 68 accounts sent plain transfers signed with their own keys, as did the nine wallets emptied that evening.

On Ethereum, BNB Chain and Polygon, 144 of 156 inflows are ordinary transfers signed by the victims at a flat gas price on each chain, almost all between 05:07 and 06:07 UTC and the last at 08:11. The other 12 are approvals followed by pulls from the operator wallet 0x381825de…, which had sent the victims gas seconds earlier.

The Bitcoin sweeps follow one script. All 279 sweeps of 7 to 9 October share one build: each spends every coin of a single address into one collector with no change, version 1, no locktime, no fee bumping, at a fixed fee rate per batch. The main batch, 112 sweeps worth 203.26 BTC ($16.84m), landed in block 970,590 at 05:54:20 UTC, 47 minutes after the first Tron and EVM sweeps. The 47 sweeps of 10 October landed in four batches of one block each.

The thief’s wallets were ready two weeks early

The thief’s wallets were funded and tested from 24 September, a fortnight before the main run. The EVM operator 0x381825de… was funded on 24 and 25 September, then rehearsed the approve, pull and sweep routine on more than a dozen throwaway wallets across five chains from 26 September to 7 October.

On Tron, the operator TAzdU79… was created on 25 September, and its first money was a Bybit withdrawal: Bybit’s hot wallet TU4vEruv… paid 14,512 TRX to TWGHw7Zs… at 16:45:53 UTC on 24 September (transaction b284a254…), and that wallet paid 13,247 TRX into the operator at 09:53:33 the next morning, its first inflow. Bybit holds the account behind the withdrawal. Between 26 September and 7 October it rehearsed the approval pull 20 times, on 20 Tron addresses created for the purpose and funded with 1 to 5 USDT, 17 of them straight from the operator: each approved the operator and was emptied by it within minutes. On 2 October at 09:20:54 UTC a 3 USDT test payment from it, passed through a second new wallet, created the first Tron collector.

The chains tie the Tron collectors to the Ethereum ones. At 06:32:06 UTC, 500,000 USDT left Tron collector TK6DWN… for a deposit address of the cross-chain swap service NEAR Intents, and 89 seconds later that service’s Ethereum payout wallet sent 197.99 ETH ($491,717) to Ethereum collector 0x83aeac16…. Six swaps placed through THORChain, a cross-chain exchange, from Tron wallets the collectors fed name the thief’s Ethereum wallets as the addresses to be paid.

Spy implants have been found inside Ledger devices

Ledger is still investigating the cause. One documented way for a genuine-looking Ledger to leak its phrase is a hardware implant that reads the recovery phrase off the device’s own screen and sends it out over a mobile network, and on 10 October Ledger confirmed one in a victim’s device.

Tibane Labs’ field report on the implants, published in October, describes three generations, each harder to spot: a 2025 prototype with hand-soldered wires and a shrunken battery; a second generation on a flex circuit, whose STM32’s date code reads as week 51 of 2025; and the newest, bought on Amazon Japan from a China-based seller and shipped from Malaysia, which hides under the screen with the original battery in place, its microcontroller and eSIM markings scraped off, a Nordic nRF9151 cellular module whose lot code reads as week 39 of 2025, and a flexible printed antenna silkscreened AC-A2016-NANO-V1.1, a part designed and ordered for the Nano X, which the report reads as a production run. All three tap the wire between the secure element and the screen, read the 24 words pixel by pixel as they are shown, and send them out over the cellular network. The secure element is never touched and the device works normally.

The hardware researcher Joe Grand presented a teardown of one, found in a Ledger Nano X, at hardwear.io USA in May 2026. His slides describe a board that “monitors SPI traffic between Nano X Secure Element and OLED”, matches the letter shapes of the recovery words, stores them and transmits them “via cellular module”. The battery was shrunk to make room.

Mark Karpelès has been publishing photographs of the same kind of implant since 16 September, from Nano X units he bought himself from marketplace sellers. He says one was on sale at close to half price on a well-known platform “via a Chinese seller (product shipped from Malaysia)”, and on 27 September he said the discounted unit he bought from a Chinese seller on Amazon had the implant. At 13:53 UTC on 9 October he posted the photographs below with the words “This looks like this could be exactly what I’m investigating”, and at 14:03 UTC he asked CryptoBilis to open devices from its stock to check.

Ledger’s own documents explain why such a device passes its checks. Its Genuine Check proves the secure chip was made by Ledger. Its support page and its security team’s threat model both say the check “cannot detect unauthorized physical modifications to the hardware, such as spying implants, if the original Secure Element remains intact”. Ledger’s support page publishes reference photographs of each model’s board so owners can compare.

Older wallets were drained too

The drained wallets range from a few days old to more than eight years old. About nine tenths of the bitcoin, by value, sat in addresses first funded within the 90 days Ledger named, and 29 of the 34 Ethereum victim wallets were first funded in that window.

On Tron, 69 of the 129 accounts drained into the four published collectors were created within the 90 days, holding 47% of the USDT taken from them; the oldest was created on 6 January 2025. On Bitcoin, 134 of the 276 addresses swept by 9 October were more than a year old, the oldest first funded on 15 June 2021, and 40 of the 47 swept on 10 October had been funded once and never spent, the oldest since August 2018.

Most of the Tron money became ether on Ethereum

The Tron collectors started moving the stolen USDT at 05:26 UTC on 9 October, splitting it into exact 500,000 USDT parcels and sending it through bridges and swap services to Ethereum, where it gathered as ether.

The ether gathered in the three Ethereum collectors and nine new wallets. Most of the stablecoins taken on Ethereum, BNB Chain and Polygon passed through Relay, LI.FI and 1inch and came back as ether within the hour. The early trail split three ways: ether through Tornado Cash and into Zcash; USDD back into USDT and through THORChain into ether; and bitcoin from the smallest collectors through fresh addresses into NEAR Intents. The 12 and 13 October route through private Railgun copies is described above.

Tether froze $10m, and the rest went through USDD and THORChain into ether

Tether blacklisted 37 addresses tied to the theft on 9 October: 35 between 12:09:39 and 12:09:45 UTC, one at 12:14:00 and one at 14:10:51. At 15:30 UTC it released four of them, THORChain’s Tron vaults, which hold every THORChain customer’s money. That leaves 10,000,001.11 USDT frozen in 20 of the thief’s own wallets, parcels of about 500,000 that it had split off between 10:01 and 11:16 UTC. One of them tried to send its 500,000 at 12:31:09 UTC and the transfer failed.

The thief had already found the way round the freeze. From 10:49 UTC on 9 October it was converting USDT into USDD, Tron’s own dollar stablecoin, at one for one through the stability module, which Tether’s blacklist does not reach. As Hacken put it at 13:45, “Tether’s USDT freeze controls do not apply to USDD.” By 16:00 UTC 15,153,572 USDT had gone that way, two later swaps of 10,000 and 70,000 USDT took the total to 15,233,572 USDT in, and 15,133,555 USDD sat in seven Tron addresses, the seventh of them TTYJ5s1b…, paid from a collector we found on 10 October. The nine wallets emptied at 20:49 UTC added 8,806,905 USDD more that evening, through the same module (update of 12 October).

Then it began turning the USDD back into USDT, round by round, and swapping the USDT into ether through THORChain, the cross-chain exchange.

Each single-use address swapped its USDD for USDT from the stability module’s vault through SunSwap’s router within two minutes, and within a minute more sent it to one of six Tron addresses that THORChain’s own vault list shows as its active Tron vaults. Each transfer carried a swap into ether for a fresh Ethereum address named in advance, and THORChain’s router paid the ether out on Ethereum. THORChain’s records name every swap. The 10 October ether went to four fresh wallets, which passed all 2,025.50 ETH ($5.07m) into one wallet, 0x3b2F9cfe…, between 15:32 UTC on 10 October and 00:53 UTC on 11 October. The 11 October ether went to 0x65B66749… and 0xC551875D…, which passed 1,075.74 ETH on to two fresh wallets, 0x5a71034c… and 0x617013EB…, at 14:50 and 14:51 UTC on 11 October.

At 15:06 UTC on 11 October 0x3b2F9cfe… held 1,828.39 ETH ($4.58m), after paying 197.1 ETH into the fourth Tornado Cash run below, and the two newest wallets held 795.49 ETH and 280.24 ETH ($2.69m together). Four of the 11 October swaps, 4,328,551 USDT ($4.33m), were still being filled for the same two addresses, 0x65B66749… and 0xC551875D…. 3,001,736 USDD ($3.00m) remained in two Tron addresses, and later that day the thief sent it through THORChain as well. THORChain’s vaults pool every customer’s money, and the steady lots of 20,000 to 70,000 USDT they pay into Binance deposit addresses are withdrawals from THORChain’s trade accounts by its other users.

The ether runs through Tornado Cash and on into Zcash

In the early runs of 9 to 11 October, the thief put ether into Tornado Cash, a mixing service that breaks the visible link between the wallet that pays in and the wallet that draws out, then withdrawals linked to the theft reached fresh wallets within the hour and were swapped into Zcash, whose shielded pool hides the sender, the amount and the destination of every coin inside it. By 09:57 UTC on 11 October the first four runs had deposited 3,783.2 ETH ($9.4m at the prices of each day), and the pools had paid 3,680.0 ETH out to wallets linked to the theft in YFarmX’s analysis. The other 103.2 ETH, from the fourth run, was still inside at 15:06 UTC, and more runs have followed since. Each deposit buys a note, a claim on a fixed 100, 10, 1 or 0.1 ETH that can later be withdrawn to any wallet.

The first run shows the shape. At 15:04:35 UTC on 9 October, ten hours after the main run began, one of the thief’s ether wallets sent 393.27 ETH ($976,705) to a new address, which split it into 97, 100, 100 and 92 ETH across four more, and from 15:17:23 those four deposited 389.2 ETH into the 100, 10, 1 and 0.1 ETH pools in 31 notes. A second ether wallet followed at 15:31:11 with 438.55 ETH and a third at 15:45:59 with 434.53 ETH, each split the same way. Every depositing wallet traces to the ether wallets by plain transfers, five of the eight were paid their gas by 0x00Bb1C23…, the wallet that had paid gas that morning for two of the thief’s bridging wallets, and the second splitter sent its leftover to the wallet that paid the first splitter’s gas. The later runs moved faster, and the fourth cut out the depositing wallets altogether: its four splitters put the ether into the pools themselves.

YFarmX’s investigation links these withdrawals to the theft. Transfers into Tornado Cash are directly visible; the links across privacy pools are analytical attributions. The first run’s three waves were subsequently associated with payments into the same three Ethereum wallets.

The traced withdrawal wallets then sent ether through a cross-chain swap service into Zcash. Zcash’s shielded transfers conceal the sender, amount and recipient. The links to later payments on Ethereum therefore remain part of YFarmX’s analysis, while the payments themselves are visible on chain.

The first and largest lot of the first run’s third wave shows the mechanism. At 16:00:23 UTC on 9 October, 49.9 ETH ($124,131) left 0x3dB57Eaf…, and at 16:02:32 Zcash transaction 8e40095e… (block 3,511,931) paid 101.61891438 ZEC ($123,843 at the swap rate) to the shielded address u1dc0wghc4hxpue9zwglzy4v0hd7grcaw5zkkqlgdc089ka78fx2vacj7trqr8nx6778n607k0k8l7dc5cu3n56yrkwcewq9r4zum6tvxg. It came back out at 18:36:50 and 18:37:51 in two transactions (2cfc41e4… and af336f1f…, blocks 3,512,057 and 3,512,058), and at 18:43:11 the swap service’s Ethereum payout wallet sent 61,109.10 USDC for the first of them to 0xc164F12C….

What came out of Zcash has been spent fast. The three 9 October wallets paid 313.18 ETH ($0.78m) into HitBTC, 47.19 ETH ($0.12m) into Coinify and two $50 tests into a Binance deposit address, and their 1,057,546 USDC went through a fresh wallet into the pooled contract 0x08eC0883… on 10 October. On 11 October the thief emptied two of the three remaining USDC wallets through a fresh 0xa2CAc565…: 1,887,364 USDC into the same pooled contract, 100,033 USDC into Bridgers, 180,000 USDC into Aeroswap through three of its deposit addresses and 400 USDC to a trading contract. At 14:46 UTC the third, 0xBA736A4b…, sent 400,000 USDC through the same wallet: 380,000 into the pooled contract, which had received 3,324,910 USDC and 59,683.16 USDT attributed to the theft by 15:06 UTC on 11 October, and 20,000 into Aeroswap through a fourth deposit address. HitBTC, Coinify and Binance hold the accounts behind their deposits.

Three large withdrawers from the same pools on 10 and 11 October, 0xfc9a8b9c… (362.5 ETH), 0x180cc487… (500 ETH) and 0x45eef13e… (710 ETH), took their notes in a way that differs from every one of the thief’s 269 withdrawals, and they sit outside the trace. So do the single 100 ETH note that 0x3b5429df… took during the second run and the Solana orders it funded.

What can still be frozen or held

Stablecoin issuers and services holding customer funds provide the clearest routes to recovery. Tether recorded a freeze of about $10m on 9 October. Circle’s USDC terms provide for blocklisting addresses, and exchanges can restrict customer accounts that receive stolen funds.

The earlier trace identified deposits at HitBTC and Coinify, worth about $0.9m at the prices recorded then, and two $50 tests into a Binance deposit address. Those figures describe the deposits observed at the time. The services hold the account records needed to investigate their subsequent use.

For NEAR Intents, the latest public status is specific: its two orders for 800,000 USDT ($800,000) were marked failed and unrefunded on 13 October, and still read that way at 15:00 UTC on 16 October. A confirmed return or freeze is a separate step in recovery.

Railgun’s public pool held 314,376 USDT ($314,376) that four fresh wallets put in on 15 October after taking 130 ETH out of Tornado Cash; no full exit had come out by 23:00 UTC that night. On 16 October, between 10:36 and 13:55 UTC, eight lots of 45,000 to 69,000 USDT came out to fresh wallets; six were sold on Uniswap for ether, and the ether and the remaining USDT were paid into one cash-out service’s collecting wallet by 14:33 UTC. The thief tested their own Railgun balance in the middle of that series, which makes it a likely match, though the lots add up to about a third more than the deposit and the exact pairing is still open. Whatever the share, the money is now pooled inside that service.

The thief’s main addresses

These are the collectors, holding wallets and ether wallets the trace ties to the thief, for anyone checking their own exposure or following the money. The table identifies their roles; current balances for the addresses checked are summarised in Where the funds are on 16 October.

What Ledger buyers in the region can do now

Ledger’s advice is to stop and move: anyone who bought from CryptoBilis in the last 90 days and has not set the device up should not start, and anyone who has should consider moving their assets to a new Ledger device with a new recovery phrase.

Ledger’s buying guide says a genuine Ledger never arrives with a recovery phrase or PIN already set. Its support page carries reference photographs of each model’s board for comparison. Victims can contact SEAL 911, which asked anyone drained to these addresses to get in touch, and Ledger’s bounty programme at [email protected].

Anyone whose Tron address holds an approval to the operator TAzdU79… should revoke it before sending anything to that address: three victims’ approvals were still live on 10 October, and one was used again at 13:38 UTC that day, ten minutes after a fresh 70,000 USDT arrived.

How the trace unfolded, newest first

The daily record below brings together the earlier observations. Amounts and balances belong to their stated dates; the 16 October entry is the latest, and Where the funds are on 16 October carries the current balances.

16 October: 150 ETH more to the Tornado Cash feeder, and the Tron money reached cash-out desks

At 13:32 and 14:34 UTC, ether wallet 2 (0xfa4EaBB8…, which funded the 13 and 15 October runs) paid 50 ETH twice to one fresh wallet, which put all 100 ETH ($246,318) into Tornado Cash in ten deposits of 10 ETH between 13:37 and 14:50 UTC. A third 50 ETH followed at 15:55 UTC, one lot roughly every hour. The ether wallet held 702.09 ETH ($1.73m) at 15:02 UTC, down from 1,192 ETH on 13 October, and 652.09 ETH ($1.61m) after the third lot.

Overnight, from 02:03 UTC, 300 ETH ($738,954) came out of Tornado Cash in three 100 ETH notes to a wallet that had taken 51 ETH out the afternoon before, on the same pattern as the 15 October withdrawals, which makes it likely the thief’s. The wallet’s 351 ETH was sold for about 857,000 USDT ($857,000) on CoW Swap and bridged to Tron; about 132,000 USDT of it came back as ether from NEAR Intents and was sold a second time, so about 989,000 USDT crossed the bridge in all. About 244,000 USDT ($244,000) went into NEAR Intents, and the rest was swapped into USDD and back and paid to cash-out desks. The five Tron wallets paid on 15 October emptied the same way, into busy wallets that also carry other people’s money. A wallet holding proceeds of the 10 October Zcash exits moved its 487.92 ETH ($1.20m) to a fresh wallet at 06:03 UTC, which swapped it into about 1.19m USDT on Tron through bridge and swap services within two and a half hours, and by 08:46 UTC that money had gone into the same group of cash-out wallets.

Dollar values in this entry use Chainlink’s ETH/USD price of $2,463.18, updated at 14:54 UTC.

15 October: 390 ETH more into Tornado Cash, and two roads out

The thief put 390 ETH ($956,643) into Tornado Cash between 06:53 and 15:04 UTC, in 39 deposits of 10 ETH from one fresh feeder wallet, which ether wallet 2 refilled eight times. The ether wallet held about 802 ETH ($1.97m) at 20:37 UTC. Dollar values in this entry use Chainlink’s ETH/USD price of $2,452.93, updated at 20:04:47 UTC.

Withdrawals in the thief’s pattern, a strong match on the 13 October pattern, took two roads out. On the first, from 11:09 UTC, a fresh wallet took 330 ETH ($809,467) out of Tornado Cash, split it across 31 wallets, gathered it, sold it for 774,821 USDT ($774,821) on CoW Swap and bridged it to Tron, where it landed in ten NEAR Intents deposit addresses. It passed through a shared account inside NEAR Intents without being swapped, and 774,970 USDT went out to five new Tron wallets, which held about $779,000 at 22:10 UTC. The steps after the pool are confirmed on chain, except the hop through the shared account, which is a strong match on amounts and timing. On the second, between 16:14 and 16:47 UTC, four brand-new wallets took 130 ETH ($318,881) out in 10 ETH notes, sold it on Uniswap and put 314,376 USDT ($314,376) into Railgun’s public pool, where it sat until the next day.

On Tron, the second of the new wallets that took the $1.59m USDC wallet’s bridge payouts (14 October, below) paid a 100 USDT test and then 999,900 USDT ($999,900) to a trading desk at 06:32 UTC. At 13:18 UTC 875,014 USDT ($875,014) passed along the same chain of new wallets, and 917,200 USDT ($917,200) reached a third new wallet about a minute later. The bridge payouts match the orders to the cent and the three wallets pay each other’s fees, a strong match.

14 October: $1.63m out of Tornado Cash became USDT on Tron, and two USDC wallets were emptied

Fresh wallets took 657.57 ETH ($1.63m) out of Tornado Cash between 13 October and 03:44 UTC on 14 October, on the same pattern as the 13 October withdrawals, a strong match, sold it on CoW Swap and bridged about 1.65m USDT ($1.65m) to Tron in 26 sends, where 1,649,309 USDT landed in 25 NEAR Intents deposit addresses. Dollar values in this entry use Chainlink’s ETH/USD price of $2,478.02 and BTC/USD price of $82,736.86, updated at 13:31:35 UTC.

Two wallets holding proceeds of the 10 October Zcash exits sold 674.89 ETH ($1.67m) between 06:34 and 08:37 UTC, and 1,234,456 USDT of it went into the pooled contract 0x08eC0883…. The two USDC wallets paid out of Zcash on 10 October were emptied the same morning: 796,559.68 USDC at 09:20:59 went through a fresh wallet into the pooled contract, Bridgers and Aeroswap, and 1,586,448.10 USDC ($1.59m) at 10:14:35 went to a fresh wallet, which started sending it to swap and bridge services at 19:34 UTC the same day (700,025 USDC in seven minutes), made its first on-chain swap the next morning, and had sold or bridged all of it, with the proceeds landing on Tron, by 13:04 UTC on 15 October. The pooled contract paid out on Tron for the thief’s deposits, and up to $1.92m of those payouts reached one trading desk through single-use wallets on 10 and 14 October: $1.44m is a strong match deposit by deposit, and $0.48m is likely.

12 October: nine more wallets brought the loss to $103.4m

Nine Tron wallets identified on 12 October had lost 8,806,905 USDT ($8.81m) in one block at 20:49:21 UTC on 9 October, bringing the total to $103.4m from 530 addresses. Each had been set up between 17 and 20 September and left untouched after funding. The largest lost 2,000,001 USDT.

The collector turned the proceeds into USDD by 21:02 UTC that evening. From 11 October, those funds followed the established THORChain route into ether. On 12 October the thief also deposited 200 ETH (about $498,520 at the 13 October price above) into Tornado Cash in five batches. The gas payments and subsequent withdrawals from that day form part of the new service connection described above.

11 October: more stolen bitcoin and further swaps into ether

A fourth Bitcoin collector identified on 11 October had swept 7.13 BTC ($591,600 at the count’s recorded price) from 47 wallets the previous afternoon and evening, including 40 wallets funded once and then left dormant. That finding brought the count at the time to 521 addresses and about $94.5m, before the nine Tron wallets were added on 12 October.

The first four Tornado Cash runs reached 3,783.2 ETH ($9.4m at the prices recorded for those runs) deposited by 09:57 UTC on 11 October. The traced withdrawal route continued through Zcash, while Tron USDD was converted back into USDT and sent through THORChain into ether. At 15:06 UTC, twelve identified ether wallets held 14,879 ETH ($37.27m), with further ether in the newer THORChain recipients. The two large Bitcoin collectors still held 203.79 BTC (about $17.0m) at the evening check. These historical figures are superseded by the broader 13 October balance check above.

10 October: exchange deposits and a confirmed hardware implant

Ledger confirmed an unauthorised hardware implant in one victim’s device at 17:09 UTC on 10 October and said CryptoBilis had stopped selling all hardware wallets. The theft count then stood at about $94.0m from 474 addresses; later discoveries raised it further.

Funds linked to the earlier Zcash exits reached HitBTC and Coinify, while the smallest Bitcoin collector began spending at 00:17 UTC. The thief converted 5.1m USDD ($5.1m) back into USDT for THORChain swaps that paid 2,025.50 ETH ($5.07m at the recorded price) into fresh Ethereum wallets. More ether passed through Tornado Cash and Zcash. The exchange deposits and these routes are integrated into the tracing sections above.

9 October: the main theft, Tether’s freeze and the first mixer run

Most of the theft took place on 9 October. Tether froze about $10m in the thief’s wallets, and Ledger asked CryptoBilis to pause sales at 13:32 UTC. The first evening count was $93.4m from 468 addresses, the figure retained in the dated illustrations above; subsequent discoveries took it to $103.4m from 530.

Between 15:17 and 15:57 UTC, the thief deposited 1,253.9 ETH ($3.11m at the recorded price) into Tornado Cash in three waves. YFarmX linked subsequent withdrawals to Zcash swaps and later payments of 384.44 ETH ($951,424) and 2,115,079 USDC ($2.12m) into three Ethereum wallets by 20:17 UTC. The privacy-pool links are analytical attributions; the surrounding deposits, swaps and payouts are public transactions.