Follow the trail. The attacker who emptied the wallets of Ledger clients probably believed he had blended in. However, the chain investigators still follow him, hop after hop. More than 100 million dollars traced, 10 million frozen by Tether. Enough to put the debate on the responsibility of hardware wallet manufacturers back at the center of the table.
Around $103.4 million was allegedly siphoned off across 530 addresses and seven blockchains according to YFarmX. Three quarters of the loot is in USDT on Tron.
Tether froze 10 million USDT on day one. The thief circumvents blacklisting by converting his share into USDD, then into ether via THORChain.
The loot passes through Tornado Cash in seven waves, then into the Zcash armored pool. YFarmX says it has linked each outgoing batch using transaction fingerprinting.
Ledger maintains that the confirmed cases involve devices sold by official reseller CryptoBilis. An unauthorized hardware implant was discovered there.
Indeed, it was through a press release published on Sunday October 11 on X that Ledger took stock of a matter that has occupied him for several days already. As a reminder, Bitquery estimates the loot at $93.2 million stolen from 315 wallets spread across six blockchains. For its part, the YFarmX investigation platform puts forward an even steeper figure.
In its investigation, updated this Monday, it recorded approximately 103.4 million dollars siphoned from 530 addresses and seven blockchains. Thus, three quarters of the amount went into USDT on Tron. In fact, both estimates are based on public on-chain data, and Ledger has not confirmed either total.
Thus, Tether blacklisted 37 addresses linked to the theft as of October 9, for 10 million USDT today immobilized in the thief's wallets. In fact, the stablecoin giant has a power that Bitcoin and ether do not offer, that of freezing tokens linked to crime. But the pirate had planned the parade. On the morning of the theft, he converted his USDT into USDD, Tron's stablecoin, via the stability module that Tether's blacklisting does not affect. Then head to THORChain, the cross-chain exchange, to exchange everything for ether.
Since day one, the pattern has been repeating itself methodically, and it has a name: Tornado Cash. YFarmX thus counted seven waves of deposits on Tornado Cash, the mixer which breaks the visible link between the wallet which deposits and the one which withdraws. After passing through the pools of 100, 10 and 1 ETH, the funds then come out into new wallets, within the hour.
The next step is played in the shielded Zcash pools. The issuer, amount and recipient of each transaction disappear. But this is precisely where YFarmX claims its feat of arms. Concretely, its tool identifies the withdrawal transactions themselves, their construction, their author and their timestamp. Announced result: 108 withdrawals out of 108 attached to their original batch âto the nearest zatoshiâ, the finest unit of the ZEC. Once released, the funds in fact feed ZEC against USDC sell orders. These pay for two newly created wallets, for 1.79 million USDC unspent at the time of the investigation. YFarmX therefore challenged Circle, reminding that the USDC issuer can still freeze this share.
The manufacturer presents the case as limited to devices sold by CryptoBilis, a Southeast Asian reseller listed as authorized on its site. A situation which has also evolved over time, the reseller having changed ownership before the thefts. Additionally, Ledger confirmed the discovery of an unauthorized hardware implant in at least one affected device. However, the company does not say how the machines were returned. On X, the criticisms are raining down.
In practice, the debate concerns a simple question: how far does a manufacturer's responsibility extend when an official sales channel serves as a Trojan horse? As a reminder, the episode has nothing to do with the phishing campaign last April. A fake Ledger Live application on the App Store cost users $9.5 million who entered their seed phrase at the time. This time, however, the attacker came into possession of the keys themselves. Enough to empty hundreds of wallets without the slightest error from their owners.
According to YFarmX, the majority of the loot today remains ether on Ethereum, which no issuer can freeze. Next come the bitcoins in two collector wallets, then the USDT frozen by Tether. Circle, Binance, HitBTC and NEAR Intents can therefore still intervene on identified addresses. It now remains to be seen whether Ledger will foot the bill, and whether these freezes will one day pave the way for concrete restitutions.
