Ledger: $103 Million in Loot Traced Through Tornado Cash and Zcash

Following the trail. The attacker who drained Ledger customers' wallets likely thought they had blended into the crowd. However, chain investigators are still tracking them, hop by hop. Over $100 million traced, with $10 million frozen by Tether. This raises the debate about the responsibility of hardware wallet manufacturers to the forefront.

Key points of this article:

• Approximately $103.4 million is believed to have been siphoned from 530 addresses across seven blockchains, according to YFarmX. Three-quarters of the loot is in USDT on Tron.
• Tether froze $10 million in USDT on the first day. The thief bypasses the blacklist by converting their share into USDD, then into ether via THORChain.
• The loot passes through Tornado Cash in seven waves, then into Zcash's shielded pool. YFarmX claims to have linked each outgoing batch through transaction fingerprinting.
• Ledger maintains that confirmed cases involve devices sold by the official reseller CryptoBilis. An unauthorized hardware implant was discovered there.

530 wallets, seven blockchains, and a hardware implant

Indeed, it was through a statement released on Sunday, October 11, on X that Ledger provided an update on a case that has occupied them for several days. For reference, Bitquery estimates the loot at $93.2 million stolen from 315 wallets spread across six blockchains. Meanwhile, the investigative platform YFarmX presents an even higher figure.

In its investigation, updated this Monday, it counts approximately $103.4 million siphoned from 530 addresses across seven blockchains. Thus, three-quarters of the amount has been converted into USDT on Tron. In fact, both estimates rely on public on-chain data, and Ledger has not confirmed any total.

Thus, Tether blacklisted 37 addresses linked to the theft as early as October 9, with $10 million in USDT now immobilized in the thief's wallets. Consequently, the stablecoin giant possesses a power that Bitcoin and ether do not offer, namely the ability to freeze tokens linked to criminal activity. However, the hacker had planned a workaround. On the morning of the theft, they converted their USDT into USDD, Tron’s stablecoin, via the stability module that Tether's blacklisting does not affect. Then, they headed to THORChain, the cross-chain exchange, to trade it all for ether.

From day one, the scheme has been methodically repeated, and it has a name: Tornado Cash. YFarmX counted seven waves of deposits on Tornado Cash, the mixer that breaks the visible link between the depositing wallet and the withdrawing one. After passing through pools of 100, 10, and 1 ETH, the funds then emerge in new wallets within the hour.

Ledger theft, day two. Since yesterday the thief has pushed ether through Tornado Cash three times, and each time on into Zcash's shielded pool. We followed every lot out the far side. Here is how, step by step.

1. THE SAME BUILD, THREE TIMES

An ether wallet pays a fresh... pic.twitter.com/qouguFbPE0
--- YFarmX 🗞️ (@YFarmX) October 10, 2026

The next step takes place in the shielded pools of Zcash. The sender, amount, and recipient of each transaction disappear there. However, this is precisely where YFarmX claims its achievement. Specifically, its tool identifies the withdrawal transactions themselves, their construction, their author, and their timestamp. The announced result: 108 withdrawals out of 108 linked to their original batch << to the zatoshi >>, the smallest unit of ZEC. Once withdrawn, the funds indeed feed into ZEC sell orders against USDC. These pay two freshly created wallets, for 1.79 million USDC unspent at the time of the investigation. YFarmX thus called out Circle, reminding that the issuer of USDC can still freeze this portion.

<< This is not a CryptoBilis incident, it is a Ledger incident >>

The manufacturer presents the case as confined to devices sold by CryptoBilis, a Southeast Asian reseller listed as authorized on its site. This situation has evolved over time, with the reseller changing ownership before the thefts. Furthermore, Ledger has confirmed the discovery of an unauthorized hardware implant in at least one affected device. However, the company does not disclose how the machines were returned. Criticism is pouring in on X.

In practice, the debate revolves around a simple question: how far does a manufacturer's responsibility extend when an official sales channel serves as a Trojan horse? For reference, this episode has nothing to do with the phishing campaign from last April. A fake Ledger Live application on the App Store had then cost users $9.5 million who entered their seed phrase at that time. This time, however, the attacker gained possession of the keys themselves. This allowed them to drain hundreds of wallets without the slightest error from their owners.

According to YFarmX, the largest portion of the loot remains ether on Ethereum, which no issuer can freeze. Next come the bitcoins in two collector wallets, followed by the USDT frozen by Tether. Circle, Binance, HitBTC, and NEAR Intents can still intervene on identified addresses. It remains to be seen whether Ledger will foot the bill, and whether these freezes will ever pave the way for concrete restitutions.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.