Ledger / CryptoBilis drain: a second Tornado Cash wave this morning, and what still sits on the thief’s wallets

Ledger said on 9 October that it was investigating losses among people who bought devices through CryptoBilis, an authorised reseller, and asked the reseller to stop selling. [Bitquery’s investigation](https://bitquery.io/investigations/ledger-cryptobilis-hack), verified at 07:00 UTC on 10 October, counts $92.9 million taken from 311 wallets on Tron, Bitcoin, Ethereum, BNB Chain and Polygon — 70.2 million USDT on Tron alone. Twenty-five Tron wallets signed the same approval within three seconds, after two weeks of test runs, which points to one thief holding all the keys.

How the keys were taken is not confirmed. SlowMist’s security chief has described a chip wired to the device’s screen that records the recovery words as they are shown; Ledger has not confirmed it. Tether froze $10.0 million within two hours. A first wave of 1,254 ETH went through Tornado Cash on the afternoon of 9 October and, as Bitquery and the analyst YFarmX showed, came back out through Zcash into three new wallets.

We do not repeat that work. Everything below is what happened after Bitquery’s snapshot, read by us on 10 October around 10:40 UTC, and what still sits where it can be stopped.

At 09:42 UTC the drain address 0x83aeaC166f6832aE3500000a24510a95a052A599 sent 468.9 ETH to a fresh wallet; two minutes later 0x69c8F401cfC6cd40Ac94691d6D7C48e3b7a47841 sent 441.5 ETH to another. Within half an hour each of the two split its ETH across five more fresh wallets: four of 96–120 ETH and one small one.

The eight large wallets then paid into Tornado Cash’s 100, 10 and 1 ETH pools — 900 ETH in all, between 10:07 and 10:21 UTC. The two small ones, about 9.6 ETH, were swept into one collecting wallet, which held 25.4 ETH when we looked. At 10:33 one of the post-Zcash wallets from the first wave also moved again, sending 48 ETH to a new address.

An irony on the side: within minutes of each move, address-poisoning bots began sending zero-value transfers to the thief’s new wallets from look-alike addresses. The thief is being targeted by the same kind of scam as everyone else.

On Ethereum the named drain and holding wallets held about 15,860 ETH at 10:40 UTC — roughly $42 million. Two drain addresses still hold 700 ETH each and a third 1,027 ETH; nine holding wallets hold between 40 and 3,450 ETH. These are the wallets the next wave will come from.

2.1 million USDC sits on two wallets that received the coins back after the Zcash round trip, about 1.06 million each. We checked Circle’s blacklist on the USDC contract at 10:40 UTC: neither is frozen. Unlike ETH, this part can still be stopped.

On Bitcoin the two drain addresses hold 203.8 BTC (92.5 and 111.3), unspent since the drain. The only new activity there is incoming dust from look-alike addresses.

We marked 43 addresses in our database as connected to this theft: the 14 drain addresses on Tron, Ethereum and Bitcoin, the thief’s control addresses, the nine Ethereum holding wallets, the three post-Zcash wallets, and the 14 relay wallets of this morning’s wave. None of them was in our database before. We did not mark the services the money passed through — Chainflip’s vault, bridges, swap services — or the victims.

The ETH holdings, the USDC wallets and the two Bitcoin addresses are on our watch list: if they move, we will update this page. If you are a CryptoBilis buyer, check your addresses on the address check page; for what to do after a theft, see stolen crypto: what to do.

It does not say who the thief is or how the devices were compromised; it repeats the published claims and names their sources. It does not say Ledger, CryptoBilis or any service did anything unlawful. The totals for the theft are Bitquery’s; the second wave, the balances and the freeze checks are ours, read on 10 October 2026.