$1.07M of the Ledger Haul Goes Through Tornado Cash; $70.6M Stays Put
Four wallets, one mixer, and $70.6 million still sitting in addresses anyone can watch.
Wallets tied to the suspected Ledger theft moved 430.2 ETH, about $1.07 million, through Tornado Cash on October 9, 2026, and some funds reached a Binance hot wallet[1]. The transfer went through four wallets[2].
After Tether froze part of the funds, the wallets swapped USDT for USDD through SUN.io and the USDD Peg Stability Module[3]. The marked wallets still held about $70.6 million[4]. That stock held 11,406 ETH worth roughly $28.35 million and 213.371 BTC worth about $17.65 million[5].
Ledger asked CryptoBilis to stop all sales and shipments of its devices while it looks into the exploit reports[6]. It said no reports involved gear bought straight from Ledger, and its systems were not hit[7].
What to do: skip the reseller’s devices — Ledger asked CryptoBilis to stop all sales and shipments while it looks into the reports[6].
Who gains, who loses
Receipts
Wallets linked to the suspected Ledger-related theft moved 430.2 ETH, worth about $1.07 million, through Tornado Cash on October 9, 2026.
“Wallets linked to the suspected Ledger-related theft moved 430.2 Ether (ETH), worth about $1.07 million, through Tornado Cash, while some related funds reached a Binance hot wallet.”
The 430.2 ETH transfer passed through four wallets.
“The transfers passed through four wallets.”
After Tether froze part of the related funds, the suspected operators converted USDT into USDD through SUN.io and the USDD Peg Stability Module.
“After Tether froze part of the related funds, the suspected operators began converting Tether (USDT) into USDD through SUN.io and the USDD Peg Stability Module.”
The marked wallets still held about $70.6 million in assets.
The reported $70.6 million balance included 11,406 ETH worth roughly $28.35 million.
“That balance included 11,406 ETH worth roughly $28.35 million, 213.371 Bitcoin (BTC) worth about $17.65 million, 13.646 million USDD valued at approximately $13.65 million and 10.909 million USDT worth about $10.91 million.”
Ledger asked CryptoBilis to halt all sales and shipments of Ledger devices while it investigated reports of an exploit.
“Ledger said it has asked CryptoBilis to halt all the sales and shipments of Ledger devices while it investigates the reports of exploit.”
Ledger said no reports involved products purchased directly from Ledger and said its infrastructure, systems and services were not compromised.
“No reports were made of products purchased directly from Ledger, and Ledger's infrastructure, systems and services were not compromised, the crypto wallet firm added.”
Cabal Desk is reporting, written with AI under human oversight. Every bracketed number opens its receipt: the source, the quoted span, the hash. Headlines and characterisations are commentary; the sourced facts are the receipts. Not investment advice. Corrections log. Editorial & legal.