A suspect linked to a major supply chain compromise of Ledger hardware wallets sold by Southeast Asian reseller CryptoBilis has begun laundering stolen funds, transferring $1.07 million in ETH (430.2 ETH) to Tornado Cash and over $270,000 to Binance. Estimated losses range from $72 million to $91 million across hundreds of victim addresses. Ledger has halted sales via CryptoBilis and instructed recent buyers to re-key their wallets, while Binance and Tether attempt to trace and freeze assets.
Attacker transfers to Tornado Cash
- ▪The source wallet linked to the CryptoBilis Ledger thefts retained approximately 700 ETH after transferring through an intermediary and four deposit wallets into Tornado Cash.
- ▪Blockchain activity reports on October 9, 2026 indicate an attacker linked to CryptoBilis Ledger hardware wallet thefts routed 430.2 ETH (worth approximately $1.07 million) to Tornado Cash across four deposit wallets.
Tracking stolen attacker assets
- ▪Galaxy Research reported that $3 million of the stolen Ledger funds had been moved into Tornado Cash and other relay accounts as of October 9, 2026.
- ▪Total assets held across wallets monitored by Arkham and linked to the CryptoBilis Ledger attacker were valued at approximately $70.60 million to $73 million in ETH, BTC, USDD, and USDT as of October 9, 2026.
Attacker transfers to Binance
- ▪Binance CEO Richard Teng and co-founder Changpeng Zhao stated that Binance stands ready to assist security analysts and law enforcement in freezing and recovering stolen funds transferred to the exchange.
- ▪The suspected CryptoBilis Ledger attacker transferred approximately $270,280 in cryptocurrency, including $256,567 in USDT and $13,710 in TRX, directly into a Binance hot wallet on October 9, 2026.
Stablecoin freezing and evasion
- ▪The attacker converted $13.65 million of stolen USDT into USDD via the SUN.io platform and its Peg Stability Module to bypass stablecoin freeze controls.
- ▪Tether froze a portion of the USDT stablecoin assets linked to the suspected CryptoBilis Ledger wallet theft addresses.
CryptoBilis supply chain compromise
- ▪Preliminary investigations point to localized hardware tampering of Ledger Nano X and Nano S Plus devices sold by Southeast Asian reseller CryptoBilis, allegedly incorporating spyware components to extract seed phrases.
- ▪Total estimated losses from the suspected CryptoBilis supply chain compromise on Ledger Nano X and Nano S Plus wallets range between $72 million and $91 million across over 470 addresses.
Ledger response and customer guidance
- ▪Ledger requested CryptoBilis to immediately halt all sales and distribution of hardware wallets while launching an official investigation into customer fund losses on October 9, 2026.
- ▪Ledger advised customers who purchased hardware wallets from CryptoBilis within the past 90 days not to set up the devices, and urged active users to migrate assets to new signers with fresh seed phrases.
Former CryptoBilis CEO response
- ▪Former CryptoBilis CEO Arravind Prabu stated he signed a non-disclosure agreement with a Chinese buyer regarding the sale of the reseller firm, with the agreement expiring on October 19, 2026.
- ▪When pressed by users for answers following theft allegations, former CryptoBilis CEO Arravind Prabu defended himself by stating that he is no longer part of the reseller firm.
TRM Labs research on exploits
- ▪A July 2026 review by TRM Labs recorded 207 crypto hacks and $972 million in stolen assets during the first half of 2026.
- ▪TRM Labs reported over $700 million in inflows to Tornado Cash through mid-June 2026, representing more than 20% of total mixer activity.
Debatable claims
- ▪Hardware wallets no longer offer sufficient security for crypto self-custody
- ▪Authorized resellers bear primary liability for hardware wallet supply-chain tampering
- ▪Decentralized crypto mixers cause more harm than good
- ▪Hardware wallet manufacturers should eliminate third-party resellers
Story comments
Loading comments…