The CryptoBilis Ledger drainer has continued moving stolen cryptocurrency, transferring USD 13.84 million over the past 48 hours after Arkham Intelligence traced USD 95.35 million in thefts involving 1,486 addresses.
- Arkham traced USD 95.35 million stolen from 1,486 addresses between October 7 and 9.
- The attacker reportedly stole USD 80.60 million within just 51 minutes on October 9.
- At least USD 69.19 million passed through swaps and bridges across multiple blockchain networks.
- The attacker deposited 9,529 ETH, worth USD 23.27 million, into Tornado Cash through 559 transactions.
- Arkham identified USD 30.44 million in remaining holdings, including USD 10 million in frozen USDT.
According to Arkham Intelligence, the thefts occurred between October 7 and 9, with most of the cryptocurrency taken during a 51-minute period on October 9. The blockchain analytics firm reported that USD 30.44 million remains in addresses linked to the attacker, including USD 10 million in USDT frozen by Tether.
Its latest investigation traced the stolen cryptocurrency through several blockchain networks, identifying transfers involving USDT, Bitcoin, Ethereum and USDD. The findings come nearly three weeks after Ledger began investigating reports of missing funds from customers who purchased hardware wallets through Southeast Asian reseller CryptoBilis.
CryptoBilis Ledger Drainer Stole USD 80.6 Million in 51 Minutes
Arkham’s analysis found that most of the theft occurred on October 9, beginning at 05:07:48 UTC. Within 51 minutes, the attacker collected USD 80.60 million, including USD 58.19 million in USDT through 335 transfers on the Tron blockchain.
During the same period, 112 Bitcoin addresses transferred 203.26 BTC, valued at USD 16.73 million, in a single block at 05:54 UTC. Another USD 14.14 million in USDT reached the attacker’s Tron wallets by 15:00 UTC.
The investigation identified smaller transfers before the main theft. Between October 7 and 8, the attacker received 7.41 BTC, worth approximately USD 610,000, from 137 addresses.
Previous estimates of the losses have varied. Blockchain analytics firm Bitquery estimated USD 102 million stolen from 335 wallets across six networks in its October 16 investigation. Ledger has not independently confirmed the total amount stolen or the number of affected customers.
Stolen Funds Moved Through Ethereum Bridges and Exchanges
After the theft, the attacker began converting the stolen assets and moving them between blockchain networks. Arkham traced at least USD 69.19 million through swaps and bridging transactions, including USD 20.37 million in USDT converted into USDD on Tron.
Another USD 20 million in USDT moved from Tron to Ethereum through USDT0. Other transfers converted USDT and USDC from Tron, BNB Chain and Polygon into ETH, including USD 8.95 million through Relay, USD 5.91 million through Chainflip and USD 13.96 million through smaller routes.
On October 9, Ethereum wallets associated with the attacker received 5,895 ETH, worth USD 14.72 million, from bridges including Relay, THORChain, NEAR Intents, Bridgers and Mayan. The attacker then converted USD 11.30 million in bridged USDT into approximately 4,530 ETH through Rizzolver.
Separate transfers sent 5,185 ETH, valued at USD 12.97 million, directly to newly created addresses. Of that amount, 3,600 ETH came from USD 9 million transferred through USDT0, while another 1,585 ETH moved through Chainflip to three new addresses.
Between October 9 and 11, the attacker sent USD 14.65 million in USDD to 20 Tron addresses. Nineteen subsequently converted the tokens into USDT through SUN.io and deposited USD 14.13 million into THORChain.
Tornado Cash Received USD 23.27 Million in Stolen ETH
Arkham identified 9,529 ETH, valued at USD 23.27 million, deposited into Tornado Cash through 559 transactions.
The deposits included 63 transfers of 100 ETH, 307 transfers of 10 ETH, 156 transfers of 1 ETH and 33 transactions of 0.1 ETH. Before the deposits, 8,102.6 ETH had moved from wallets linked to the attacker into 26 new Ethereum addresses.
Bitcoin transfers continued separately. Arkham traced 102.15 BTC, worth USD 8.33 million, leaving the attacker’s wallets through four transactions. On October 27, a 17.97 BTC portion joined 52.51 BTC in an unspent output containing 70.47 BTC, worth USD 5.67 million.
The firm’s latest figures show 4,932 ETH worth USD 11.49 million and 111.28 BTC worth USD 8.96 million in tagged addresses. Another 10,000,010 USDT remains frozen on Tron following Tether’s October 9 intervention.
Ledger Confirmed Hardware Implant in CryptoBilis Wallet Investigation
The findings follow Ledger’s investigation into compromised hardware wallets sold through CryptoBilis. As crypto.news previously reported, Ledger confirmed on October 13 that its security team had discovered an unauthorized hardware implant capable of capturing recovery phrases displayed during device setup.
Ledger said every confirmed theft it had investigated involved a device purchased through CryptoBilis, although it had not established how the components entered the affected hardware. The manufacturer subsequently tightened reseller security requirements and suspended authorized hardware wallet sales across several Southeast Asian markets.
In a related development, Singapore police reported two compromised wallet cases on October 28, involving approximately SGD 3.5 million in cryptocurrency losses. Preliminary investigations found that malicious components inside the affected devices could capture users’ recovery phrases or private keys.
Ledger said its investigation had not identified evidence that its internal systems or direct sales channels were compromised.
