The suspected attacker behind the CryptoBilis hardware-wallet compromise is working the stolen funds through a laundering circuit that mixes Tornado Cash, Zcash, unfreezable stablecoins and exchange OTC desks — and on-chain evidence shows the trail reappearing at every exit point where it can still be frozen.
Blockchain analytics firm Bitquery, publishing a continuously updated investigation last revised October 11 at 07:00 UTC, now counts $93.2 million taken from 315 wallets across six chains — TRON, Bitcoin, Ethereum, Solana, BNB Chain and Polygon — in the incident that began October 9 and that Ledger has linked to devices sold through its Southeast Asian reseller CryptoBilis. Ledger has confirmed an unauthorized hardware implant in one victim's device; no attribution for the operation has been made.
Two Days, 2,990 ETH, One Circuit
The laundering pattern is consistent across both days. On October 9, three batches totaling 1,254 ETH went into Tornado Cash beginning at 15:17 UTC — within two hours of Ledger's public statement — emerged in six new wallets, and were swapped into Zcash in 41 lots before resurfacing as 384 ETH and 2.1 million USDC.
On October 10, the suspected attacker ran another 1,736 ETH through the same Tornado Cash–Zcash circuit, and the coins came out as USDC. Five wallets now hold 5.35 million USDC that Circle can freeze. The two-day total through the mixer stands at 2,990 ETH, worth roughly $7.45 million at the time — a figure independently corroborated by PANews, KuCoin and Phemex.
The TRON Leg: Unfreezable Coin, Rerouted
On TRON — where most of the haul was taken — the suspected attacker had earlier converted 14.9 million USDT into USDD, a stablecoin Tether cannot freeze, and Tether blocked 37 linked addresses within hours, freezing $10.0 million in USDT.
The October 10 update shows how that frozen-out position is being moved anyway: 5.1 million USDD was swapped back into USDT, and the OTC-style wallets that took it in then paid 5.2 million USDT into Binance — deliberately mixed with other clients' money, complicating any freeze. Roughly 10 million USDD-equivalent from the theft remains in the suspected attacker's wallets, and about $81 million of the total taken could still be found on-chain as of the latest update.
The Choke Points Held
The tracing illustrates the practical limits of mixer-based laundering at this scale. Tornado Cash obscures the deposit-withdrawal link, but the funds keep exiting into instruments with kill switches: USDC controlled by Circle, USDT controlled by Tether, and accounts at a major exchange with identity records. The unmoved Bitcoin — 203.8 BTC from 122 wallets — remains the one large pool with no custodian to freeze it.
Every wallet in this report is identified through on-chain analysis by Bitquery; the identity of the person or group operating them is unknown. Ledger's guidance stands: anyone who bought a device through CryptoBilis should not initialize it, and users of configured devices should move assets to a new signer with a newly generated recovery phrase.
TrustGrade tracks the security posture of platforms and protocols in digital assets. Verified trust data: trustgrade.ai.