A hacker suspected of targeting buyers of Ledger wallets through the reseller CryptoBilis has moved 430.2 ETH, worth approximately $1.07 million, into Tornado Cash via four separate wallets, according to Onchain Lens' report dated October 9, 2026. An additional $270,280 was sent to Binance. Investigators can observe the transactions, but watching the flow of funds is a different matter from stopping it.

Four wallets into the mixer, a hot wallet at the exchange

Tornado Cash is a mixer protocol that pools deposits from many users into shared smart-contract pools and pays withdrawals out to fresh addresses, breaking the direct link between source and destination. Although Tornado Cash makes it considerably harder to match deposits with withdrawals, it has not eliminated the possibility of tracing the funds through other avenues.

A further October 9 report from Onchain Lens revealed that $256,567 in USDT and close to $13,710 in TRX had been sent to Binance, with a $22,390 USDT transfer already counted as part of the total USDT sum. The funds were reportedly placed in a hot wallet at the exchange — an internet-connected wallet used to process deposits and withdrawals. Assets in Binance's custody can still be frozen; recovering them, however, is another story altogether.

Tether freezes USDT as wallets shift into USDD

Tether has frozen some of the USDT linked to the suspected theft — a lever built into the token itself, since the issuer can blacklist addresses at the contract level. Other funds were reportedly converted into USDD, a decentralized stablecoin issued on the TRON network, through the SUN.io platform and its Peg Stability Module, according to TokenPost. Frozen USDT could not be swapped for anything.

A TokenPost report from October 9 valued the suspected hacker's assets at roughly $70.60 million in ETH, BTC, USDD, and USDT. While the wallets monitored by Arkham offer a closer view of these holdings, the valuation cited in the report is not the confirmed amount of funds allegedly lost.

According to the FATF's March 2026 report, stronger measures are necessary to ensure the freezing and blocking of all questionable stablecoin transactions. Yet the use of USDD demonstrates that criminals can shift funds outside the scope of such rules.

Ledger is still investigating, and the $90M figure is not confirmed

On October 9, Ledger announced on X that it was investigating claims involving Southeast Asian CryptoBilis customers and had asked the vendor to stop distributing the devices, as Cryptopolitan reported. Customers who purchased products within the past three months were advised not to use the new devices, while existing users were told to move their assets to a new signer with a fresh seed phrase. The advice reflects how hardware wallets are designed: the seed phrase is generated on the device and kept offline, so a new signer paired with a fresh seed phrase removes any dependence on a seed that could have been compromised.

According to an article by The Block, published the same day, estimates from tanuki42 and Specter ranged from $72 million to $86 million and were based on analysis of blockchain activity. Figures reported by Binance News October 9 put the total at $90 million. None of these figures has been confirmed as actual loss estimates, and they may refer to different wallets.

Changpeng Zhao, one of the co-founders of Binance, has advanced the theory of a vendor-specific supply chain attack, in which a device is compromised between manufacture and delivery. Mark Karpelès, the former CEO of Mt. Gox, has raised the possibility of device tampering. Neither theory has been validated or confirmed.

Why mixers and stablecoin swaps keep beating recovery efforts

Sanctioned by the U.S. Treasury in 2022 and removed from the sanctions list in March 2025, Tornado Cash has remained a routine stop for stolen funds. TRM Labs reported more than $700 million in Tornado Cash inflows through mid-June 2026, accounting for over 20% of mixer activity. Its July review counted 207 hacks and $972 million stolen in the first half of the year. Cryptopolitan previously reported that Tornado Cash appeared in 42% of exploits studied by Global Ledger.

For wallet owners, the biggest concern remains the supply chain. Ledger has not confirmed device tampering. Its findings, Binance's response, and further wallet movements may ultimately determine how much can be recovered.