Arkham Intelligence traced $95.35 million stolen from 1,486 addresses in the CryptoBilis Ledger drainer case. The attacker is still moving funds, and $10 million in USDT sits frozen. Ledger has not independently confirmed the total stolen.
The CryptoBilis Ledger drainer moved $13.84 million in the past 48 hours, according to Arkham Intelligence, which traced $95.35 million in thefts involving 1,486 addresses. The blockchain analytics firm says the thefts occurred between October 7 and 9.
Arkham reports $30.44 million remains in addresses linked to the attacker, including $10 million in USDT frozen by Tether. Estimates of the losses vary: Bitquery put the figure at $102 million stolen from 335 wallets across six networks, while Ledger has not independently confirmed the total or the number of affected customers.
$80.60 million taken in 51 minutes
Most of the theft happened on October 9. Arkham found the attacker collected $80.60 million within 51 minutes, including $58.19 million in USDT through 335 transfers on the Tron blockchain.
In the same window, 112 Bitcoin addresses transferred 203.26 BTC, valued at $16.73 million, in a single block.
Funds routed through swaps, bridges and Tornado Cash
Afterward, the attacker started converting the loot and moving it between networks. Arkham traced at least $69.19 million through swaps and bridging transactions, including $20.37 million in USDT converted into USDD on Tron. On October 9, Ethereum wallets tied to the attacker received 5,895 ETH from cross-chain bridges including Relay, THORChain, NEAR Intents, Bridgers and Mayan.
The attacker also deposited 9,529 ETH, worth $23.27 million, into Tornado Cash through 559 transactions. Bitcoin moved separately: Arkham traced 102.15 BTC, worth $8.33 million, leaving the attacker's wallets through four transactions.
Ledger points to a hardware implant
Ledger confirmed on October 13 that its security team found an unauthorized hardware implant able to capture recovery phrases shown during device setup. It said every confirmed theft it had investigated involved a device bought through CryptoBilis, though it had not established how the components entered the affected hardware wallets.
Ledger said its investigation had not identified evidence that its internal systems or direct sales channels were compromised. Singapore police, meanwhile, reported two compromised wallet cases on October 28, involving approximately SGD 3.5 million in cryptocurrency losses.
Source: crypto.news
Trading involves risk.
Risk Disclaimer
